Security update + fixes

Configuration files are now moved to the subdirectory "conf/", and
configuration adds support for specifying hidden resources.  Any URL
which matches one of these entries is rejected with a 403 Forbidden
error status code.

Also fixes some broken code on the secure server.
HTTPS support, Dashboard update 6

Removes the use of the secure server kernel and allows the web.js file
to spawn an HTTPS-enabled server instance as well (port 443); both the
insecure (HTTP) and secure server instances rely on the same
configuration data and code, and are thus fully capable of acting as
both an API proxy and static web server.  Additionally, whenever an
incoming connection fails the authorization test, it will be redirected
to "https://hostname/login.html" rather than a potentially separate
server entity.

This commit also includes minor updates to the Dashboard, namely for:
data serialization, API support, and knockout UI/event flow.