Use basic HTTP auth

- also change how the app is started -- now we use app.coffee
- nodemon added and aliased under npm start - use this for development
  live reloading
- simplified server.coffee, added comments
- update Procfile to start app directly with coffee