Staff Pick SMS report backs

#### What's this PR do?
A `/reportback/:campaign` endpoint is added that will walk a user through the report back process.

#### Where should the reviewer start?
###### server.js
On app launch, it will login to the Drupal API. Here it retrieves the session name, id, and auth token that will be needed later to make authenticated requests.

###### /lib/reportback/index.js
The logic for receiving a POST request and guiding a user through the report back flow happens here.

###### /lib/reportback/reportbackModel.js
Document model for storing the data and state of a user's report back.

###### /lib/reportback/reportback.test.js
Tests model state changes and that correct messages get delivered at each step. Does NOT however test successful submission of a report back through the `ds-content-api`.

###### /lib/ds-content-api
This library provides a basic wrapper around making calls to our DS Drupal content (API)[https://github.com/DoSomething/dosomething/wiki/API].

###### New environment variables
- `DS_CONTENT_API_USERNAME`: Username to login to API
- `DS_CONTENT_API_PASSWORD`: Password to login to API
- `DS_CONTENT_API_PASSWORD_KEY`: Key provided for password generation for new accounts
- `DS_CONTENT_API_USER_REGISTRATION_SOURCE`: Source of user registration. In this case, likely will be set to 'sms'

#### How should this be manually tested?
`$ npm test` tests the logic and state changes through a report back process.

You can also try POSTing to the `/reportback/test` endpoint for a more complete test.

I can at least confirm going through both successfully.

#### Any background context?
This replaces the SMS report back code in the github.com/DoSomething/dosomething repo.

#### What are the relevant tickets?
Closes #237 

@tongxiang This is a hefty one. Let me know if I should come over and review it with you.
cc: @aaronschachter 
Do you think it would be necessary to handle errors in this promise chaining? Should we pass in an error-handling function as the second argument in the `.then()`s?

(I have horrible memories of trying to debug errors which were swallowed into promises and went unreported, but I'm not sure if this is necessary with the reportBack db calls.)