Merge-a-geddon

Like armageddon but worse...

This pretty much is everything since 0.3.0 started, which is quite a lot. Starting with the most recent:
 * Bug fix - auth middleware shouldn't get added to sockets twice
 * Bug fix - user middleware should always come after auth middleware
 * Simplify passport and http module interaction
 * Fix broken socket.io authentication in ws.adapter.spec
 * Add istanbul to gulpfile
 * Middleware wasn't correctly supporting 'eager' route definition
 * Shifted Passport creation closer to actual usage
 * Put missing demo dependencies into package file
 * Do not set defaults on AutoHost's request instance
 * Make try/catch opt-in for route handles
 * Return 500 error when handle throws exception and using error handling for routes
 * Allow definition of routes before calling init
 * Support header setting on envelope reply
 * Support cookies on envelope reply
 * Added opt-in feature that pre-parses path variables for access within middelware. This could be terrible.
 * Pass req.context to auth provider getUserRoles when calling from passport middleware.
 * Pass user object to auth libs vs. user.name.
 * Fix edge case causing passport middleware to re-authenticate users already in the session if the user object didn't have a `name` property.
 * Remove the _autohost API/UI
 * Pass request context to checkPermissions call to enable contextual authorization
 * Add support for returning multiple resources from a single resource file
 * Add support for a resource-level URL prefix
 * Bug fix causing regular expression URLs to get incorrectly prefixed with '/' when no api or url prefix was specified.
 * Bug fix for regular expression urls in the resource action. Add feature to prefix regular expressions with url and api prefixes.
 * Bug fix to prevent duplication of url and/or api prefixes when using a urlStrategy (as with hyped).
 * Overhaul of resource loading/timing to support hyped
 * Add ability to supply url generation strategy (for use with hyped)
 * Refactor resource loading so that all resources are loaded before being passed on to the adapters
 * Eliminate "feature" that prefixes action URLs with resource name - ultimately a bit of a dead end...
 * Redesign of resource format
 * Addition of extension points
 * Init now returns a promise with a list of loaded resources
 * Add ability to disable built-in options middleware