Feature/ngui auth header

follow-up to #562 re #554

 * renames MYAPI_PREFIX to myApiPrefix, because although we use it as a constant, it is a factory and hence not injectable in config blocks.

 * delays app bootstrap until we fetch /config.json, which contains runtime config + gives us the authorization header to use on API calls.

@wolf31o2 I believe this implements what we discussed today over hipchat regarding sharing the reverse-proxy auth with CORS port.
https://docs.angularjs.org/guide/providers#providers_provider-recipe

<serviceId>Factory for naming. That way we know that it is using a factory recipe. Any thoughts? Needn't go in this PR but for later reference.