Add and use new /app.js

This should obviate constants, templates, and /api/user (with related
change).  See #1573