Add basic HTTP authentication

Sharing the prototype with other members of a team requires deploying
it somewhere, typically Heroku. It may not be desirable to, at the
same time, share it publicly.

This commit sets up basic HTTP authentication so that a user of the
toolkit can specify one username and password which will be required
to access the prototype.

Enabling authentication requires setting the environment variables
NODE_ENV, USERNAME and PASSWORD. Authentication will only be active
where NODE_ENV is set to 'production'.