Make sure static middleware runs before auth

By putting the static middleware in the top level app.js we prevent the
auth middleware from running unnecessarily for static requests.
Add test for login processing

This checks that given a valid account the user can login successfully.