Infra 167 web oauth2

This PR adds google oauth2 login wall for any endpoints typically accessed via a browser. The API endpoints remain on Basic Authentication for compatibility reasons.

Changes include:
* use Passport library + Google strategy for authenticating web endpoints
* added "dev.sh" script to ease launching a development version
* separates authentication pieces into lib/auth.coffee module
* Down tunes the noise, console.logs become debug statements
* Adds rudimentary tests for each endpoint that uses basic or no auth
* Adds testing of auth module.
* New ENV vars are 
    * GOOGLE_CLIENT_ID => From google developers console
    * GOOGLE_CLIENT_SECRET => "
    * ALLOWABLE_DOMAINS => JSON parseable array of email domains allowed to access this service
    * SESSION_KEY => Should be a high entropy string to secure sessions from attack