Update to latest version of popit-api

This incorporates the fix for elasticsearch timing out after bulk
requests.
add passport and related auth modules

update package and shrinkwrap
Add passport-local strategy for legacy auth

This allows users to log in using their instance-specific email and
password. Eventually this will become the fallback to the main site-wide
login, and in the long term this will go away entirely.
Remove commented out basic auth middleware
Use passport to authenticate the login request

This removes the custom auth handling code from the route handlers and
leaves it up to passport to do the actual auth.
Add site wide account mechanism

Falls back to instance based auth
Include basic registration page
Login allow access to all instances
Fix jshint warnings
Add master method to popit class

This enables easy access to the master connection rather than having to
store a separate one for accessing accounts.
Add configurable cookie domain to session middleware

Allow the cookie domain for the session middleware to be configured and
default it to the new setting.
Move registration app out of the main auth app

This allows us to use the registration part of the auth app in the
hosting app rather than in the instance app. This is preferable because
people will want to register for an account before creating an instance.
Split up the app from the server

By separating these two modules we can test the application in isolation
using supertest without having to worry about the server starting up and
binding to a port.
Move sessions and auth into the master app

Rather than handling these separately in the hosting and instance apps
it's more straightforward to just handle these in the top level
application. By doing this we can reuse the same logic to keep the user
logged in across instance and hosting apps.

I've also switched the sessions to use signed cookies rather than mongo
which is much simpler and removes problems with hanging connections when
testing.
Tests for the registration process

These are some basic tests for the popit registration process. They're
full integration tests, so hopefully they can be a basis for future
tests are of sort.
Add user information in the head of hosting app

This information isn't actually shown to the user (it's commented out)
but it is used in the tests to assert that the user is logged in (or
not).
Don't delete css before running tests
Fix bug with duplicate email addresses

Make sure the errors variable is populated with the failure message in
the template.
Fix login page for hosting app

Trying to get the login page working on both the hosting app and the
instance app was proving to be a lot of trouble. For the time being just
move the login to the hosting app. This does break guest logins, but
we're going to have to reconsider how they're going to work now we're
switching to site-wide accounts.
Fix logout route and add test

Now we're using cookie based session storage there is no destroy method,
you simply have to assign null to the session to clear it.
Don't show legacy auth failure messages

This can be confusing since the same error is repeated twice. Arguably
this is a bug in passport since it should handle the returned error
messages, but this fix seems to work well for the time being.
Make sure static middleware runs before auth

By putting the static middleware in the top level app.js we prevent the
auth middleware from running unnecessarily for static requests.