Move legacy auth app back into instance app

Because the hosting app uses the masterSelector, it's 'req.popit' object
is only connected to the _master database. This means that when the User
model is accessed in the auth app it actually looks in the _master
database's users collection, which doesn't exist.

By moving this app into the instance app we can have this handle both
legacy and new-style logins, then have a separate login app for the
hosting app which just handles new-style logins.
Add separate login for hosting app

This only handles new style logins, since on from the hosting app
there's no way to know which instance the user is trying to log into
using their legacy credentials.
Use passport-http for API authentication

This allows both legacy and new accounts to authenticate over the API.
Prompt user to upgrade their legacy account

When a legacy account is detected take the user to an upgrade page which
allows them to associate their legacy instance with a new-style account.
Fix auth tests

Make sure the login route redirects upon success and the logout route
exists.
Simplify auth tests

supertest provides a variety of ways to assert the headers and body of
the response are correct, so use those rather than doing comparisons in
the 'end' callback.
Upgrade user's account after successful login or registration

When a user successfully logs in or registers after being prompted to
create an account create a new permission document which links their
account to the instance being upgraded. This uses the
legacyAccountUpgrade middleware, which looks for a legacyInstanceId in
the session and if found uses it to create appropriate permissions.
Tell the user when their account is being upgraded

Add a message to the login and registration forms when the user is
upgrading their account telling them what's going on and then when the
upgrade is complete show a flash message telling them they have been
upgraded.
Link to the hosting app registration page

The instance app doesn't have a registration page, so we link to the
hosting app's registration from the legacy account upgrade page.
Check if user has already upgraded their legacy account

We don't want to allow the user to upgrade their legacy account more
than once since it would result in duplicate entries in the permissions
collection. If they try to login with a legacy account then an error
will be shown telling them to login with their new site-wide account.
Remove User lookup from deserializeUser

It is no longer possible to login with a legacy user account, you now
must use a popit site-wide account.
Put passport related things into separate module

The passport configuration is used in several places, but was being
configured in the auth module, which worked, but only by accident. This
forces all places which require passport to use this module, which will
ensure it's configured correctly.