cleaned up routes, fixed db bug, added bid route

Renamed he /api/bids/:startkey to /api/auctions/:auctionId/bids. This
returns all the bids for an auction.

Renamed the /auctions/:auctionId view and api routes to
/auction/:auctionId. This seems more clearer since it only returns one
auction along with the winning bids if any.

Removed any leftover references to auction in the profile and ads js
pages.

Found a potential exploit in our DB calls where the getAuction call
depends on the couch.get call. We blindly pass in any ID and accept
without verification that the type returned is of the type we're looking
for. I've added checks to ensure that the type returned is of the type
we're looking for. Example, try to get an auction with the ID of a bid
will return the bid. We DON'T want this to happen.

Lastly, I added the /api/bid/:bidId route so you can get a specific bid
through the api as long as you have the bid ID.