ID-42 (3): Fixed password middleware relying on req.session

My changes in #9 broke the middleware used to validate passwords. (note to self: should be testing that piece of middleware.) It was using `req.session.user.password` to check the hash, and my change removed `password` from the session data.

I've stuck by that change and am using a query to re-obtain the user object in this middleware function. Here's why:

- The session object is accessible from the view renderer. This means that anyone who maliciously manipulates ejs (for example code injection) could potentially read password hashes. I'd rather not have to worry about this point of failure.
- There's only a minimal performance drawback to adding a DB query here, since few users are changing their passwords.
- While session data is stored on the same MongoDB server as the user table is *right now*, there's always potential to move session data elsewhere in the future (e.g. redis, for faster performance). I'd prefer the minimum number of copies of password hashes, regardless.