Added passport and plugins for LocalStrategy authentication

This is only used on the /auth/login route to authenticate the user, after
what a bearer strategy will be user on every other request.

Added passport, passport-local & passport-local-mongoose
Added config for it
Added it to the login route
Fixed User model export
Fixed error reports from mongoose.

Errors are in an array. Must user toString for them to be properly
logged by Winston, otherwise nothing is printed.