fix logging: in search "error" can be legitimate output (package named "error"), not an actual error

ref #65
use req.query instead of manually parsing querystring

ref #65
better access control for search

For each of the packages check if user has access to it and remove
package info from the result if he doesn't.

ref #65
fix tests