improved logging and meta-cubifying of progress reports.

metalog:
* metalog.info('foo', {...}) for progress recording -- sent to log by default
* metalog.minor('foo', {...}) for verbose recording -- sent nowhere by default
* metalog.event('foo', {...}) cubifies the event and sends it to info
  - metalog.event('foo', {...}, 'silent') to cubify but not log
* retargetable:
  - metalog.loggers.minor = metalog.log to log minor events
  - metalog.loggers.info  = metalog.silent to quash logging

also separated db test helpers into own file and added fixture ability.
Added authentication: allow_all, read_only, or mongo_cookie

* authentication.authenticator(name) gives you the requested authenticator
  - server.js uses options['authenticator']
  - 'allow_all' is default in bin/collector-config.js etc.

* authenticator.check(request, auth_ok, auth_no)
  - calls auth_ok if authenticated, auth_no if rejected
  - staples an 'authorized' member to the request object:
    - eg we use 'request.authorized.admin' to govern board editing
    - in the mongo_cookie authenticator, it's the user record

* mongo_cookie authenticator compares bcrypted cookie to a stored hashed secret
  - you must set the cookie and store that db record in your host client; see
    'test/authenticator-test.js' for format. Rails+devise snippet available on request.
Set CORS headers for collector

Set CORS headers for collector so events can be submitted directly to
cube from any web site.

Collector now accepts OPTIONS requests for /1.0/event and
/1.0/event/put.
Add OPTIONS support to evaluator
fix OPTIONS handler
Merge remote-tracking branch 'infochimps/pr2_authentication' into cors-support
Add signed_request authenticator

The signed_request authenticator requires and Authorization header be
present of the form:
Authorization: SIGNED_REQUEST <SIGNATURE>.<PAYLOAD>
where signature contains a base64-encoded SHA256 HMAC signature of the
payload.  The payload is expected to be a base64-encoded JSON object
representing the user making the request, but the payload is not
currently used.
Add email_restricted_signed_request authenticator

The email_restricted_signed_request first validates the signed request
using the signed_request authenticator.  Then it validates the domain of
the user's email address provided in the signed request.
Extract the user info from the signed request and add to event
fix whitespace
Configure to start using foreman

Configuration is read out of .env file.

The collector is started on port 1080.
The evaluator is started on port 1081.
Both are started with node-supervisor.
Merge branch 'record-user'