Support bearer token based authorization

 - JWT (Json Web Token) is used.
   http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-19)
   arguments of our JWT include iss(User._id as value), exp(7days)
   JWT is issued when user is authenticated no matter which accounts used, local accout or social networks like facebook
   And then JWT is stored in 'access_token' field of 'User' database
 - backend server checks bearer token to decide if it permit resources for a request
   currently backend checks only expired priod of access_token is valid.
   (if you want, you can customize check conditions to specific resources using 'scope')
 - frontend saves access token passed by backend into its localstorage.
   this localstorage is used whenever frontend is relaunched.
   if 'access_token' is defined in localstorage and has valid value at launch,
   frontend display profile page directly without authenticating again (login)
 - if frontend is logouted using logout button, 'access_token' of localstorage is set to null
 - frontend alway watch change of access_token value, and save it to localstorage.
 - frontend should fill 'Authorization' field of request header to
   access token (bearer type) passed from node.js backend after authentication
 - currently supported resource is only '/api/profile'
   if you want to add a resource accessable by frontends,
   you should add passport.authenticate('bearer') for the resource url
   This makes passport check 'Authorization' field of request header

 - (TODO) Do I need to make oauth2 provider on my node.js server?
          I think that.. If I doesn't open API of my app to 3rd apps, oauth2 provider
          is not uneccessary.
 - (TODO) Support access token reissue feature if access token for request from frontend is expired