Scaffolding backend auth system

Coming to the, probably obvious, conclusion that absolutely nothing except routes/simple http should be on the front-end.  Putting everything else on the backend also solves CORS.