Move legacy auth app back into instance app

Because the hosting app uses the masterSelector, it's 'req.popit' object
is only connected to the _master database. This means that when the User
model is accessed in the auth app it actually looks in the _master
database's users collection, which doesn't exist.

By moving this app into the instance app we can have this handle both
legacy and new-style logins, then have a separate login app for the
hosting app which just handles new-style logins.
Add separate login for hosting app

This only handles new style logins, since on from the hosting app
there's no way to know which instance the user is trying to log into
using their legacy credentials.
Use passport-http for API authentication

This allows both legacy and new accounts to authenticate over the API.