NPM resource modules, global urlPrefix, better session support

 * Support loading NPM modules as resources
 * Enable setting a global urlPrefix to support reverse proxy scenarios
 * Expose session on envelope
 * Enable use of connect-redis
 * Update demo to show HTML auth without using forms-auth
 * Update README to document new features and session configuration
 * Clean-up linting errors in some files
At first glance, this appears to shortcut the error flow, so the next then handler will fire. Just curious if that is the case.