add basic permissions system

add a permissions collection to master db and use this to determine if a
logged in user can edit an instance.
on request setup add a permissions object to the req and locals which
only contains a can_edit_instance property at the moment but cuold be
expanded in future
Also update the templates to use this
store the permissions in an object in the collection

That way we can have multiple permissions for each user/instance
relationship
Move legacy auth app back into instance app

Because the hosting app uses the masterSelector, it's 'req.popit' object
is only connected to the _master database. This means that when the User
model is accessed in the auth app it actually looks in the _master
database's users collection, which doesn't exist.

By moving this app into the instance app we can have this handle both
legacy and new-style logins, then have a separate login app for the
hosting app which just handles new-style logins.
Add separate login for hosting app

This only handles new style logins, since on from the hosting app
there's no way to know which instance the user is trying to log into
using their legacy credentials.
Use passport-http for API authentication

This allows both legacy and new accounts to authenticate over the API.
Prompt user to upgrade their legacy account

When a legacy account is detected take the user to an upgrade page which
allows them to associate their legacy instance with a new-style account.
WIP Upgade from legacy auth to site-wide account

This still needs to

- Confirm to the user that the upgrade was successful
- Remove the old user account after the upgrade has been completed
- Be tested properly