Client side authentication

### Problem

Currently, the client has no notion of authentication and view control based on the auth status.

### Solution

Created an `authService` to manage the API calls for authentication. A successful login creates a global user object at the `$rootScope` that currently only maintains an email address. Other controllers or services can subscribe to the login/logout events published as members of `authEvents`. A successful logout invalidates the global user object.

These changes control authentication from the aspect of view control. In practice, one could find the views/templates that are hidden from a user who is logged out, but since the server-side auth control checks every request, the heart of the API is still protected.

### Other changes

* created a nav module to decouple from the index
* delegated the responsibility for a `container` div to the templates loaded into the ngView

### Notes

This work brought up some other issues with the UI (i.e. the need for an `alertService`), so new cards will be created for that work.

![screen shot 2014-11-27 at 5 42 28 pm](https://cloud.githubusercontent.com/assets/965744/5222527/d968f368-765f-11e4-9c4c-e5628f54da6f.png)
![screen shot 2014-11-27 at 5 42 47 pm](https://cloud.githubusercontent.com/assets/965744/5222529/ddda6f76-765f-11e4-8f2f-41bed1ebaaf3.png)


@ngmiller @zach-taylor agreed server should return 401.