Add checks to spk tool to block overly-large apps.
Enable authentication on MongoDB, with password stored in a file readable by the server's group.

Previously we just left the DB fully-accessible to anyone on localhost, which is probably fine for most users, but since we claim that the Sandstorm instance is only accessible to people in the corresponding group, we really ought to protect it as such.
Enable Mongo oplog and Meteor oplog tailing.
Bug fixes.