Add ability to expose app and request locals as private variables

This is an update to https://github.com/donpark/hbs/pull/63 that corrects the test fixture.

All tests pass.

![screen shot 2014-05-30 at 7 06 27 pm](https://cloud.githubusercontent.com/assets/2625486/3137211/0cf96a9a-e84f-11e3-86a0-4d3a8366ecdc.png)