Initial oath code
Protect URLs, add session support
Add bearer strategy for ajax authentication

Made userService kinda do something (async)
Change userService to use Mongo
Refactor security, still needs a lot of work

TODO: Get security.js to check to see if express has the session
  middleware (no clue how)
Add login page, don't secure /