Dropped NeDB support, added proper login, added GET/POST /events and OPML export, pulled the express app and auth middleware out into their own modules