added password hashing on user creation

fixes #13
removed table header
fixed renaming mistake

"feedbacks" was accidentally renamed to "challenges" so the view did not find anything any more
split utils and security libs, added first API test with auth token
moved all authorization handling to insecurity.js
added tests for authorized API usage