Match image dowload URL to API endpoint URL

The UI used to use a different URL scheme for images which was different
from the endpoint used in the API but this has now been resolved so make
them match in the API output

Also fixes PUT requests to /:collection/:id/image to return unsupported
method.

For #84
Pretty print json in production
Don't embed memberships unless requested

This changes the way that memberships are embedded with the ?embed
parameter. If you just provide 'membership' then the first layer of
memberships are populated (the default behaviour), 'membership.person'
will populate the people in the first layer of memberships, but not
those peoples memberships, 'membership.person.membership' will populate
the people's memberships as well. The same goes for organizations.

I've changed the embed population to be a mongoose plugin, which
tidies up the code in src/app.js a bit to just call a method on the
model.

I've also removed the recursive membership population in favour of using
the async module, which makes it a bit easier for my brain to grok.