AccessToken: optional `options` in findForRequest

Fix `AccessToken.findForRequest` to correctly handle the case when
the options argument was omitted:

    AccessToken.findForRequest(req, cb);
Scope app middleware to a list of paths

Add a new argument to `app.middleware` allowing developers
to restrict the middleware to a list of paths or regular expresions.

Modify `app.middlewareFromConfig` to pass `config.paths` as the second
arg of `app.middleware`.

Examples:

    // A string path (interpreted via path-to-regexp)
    app.middleware('auth', '/admin', ldapAuth);

    // A regular expression
    app.middleware('initial', /^\/~(admin|root)/, rejectWith404);

    // A list of scopes
    app.middleware('routes', ['/api', /^\/assets/.*\.json$/], foo);

    // From config
    app.middlewareFromConfig(
      handlerFactory,
      {
        phase: 'initial',
        paths: ['/scope', /^\/(a|b)/]
      });
Merge pull request #813 from strongloop/fix/AccessToken.findForRequest

AccessToken: optional `options` in findForRequest
Merge pull request #837 from strongloop/feature/scope-middleware-to-path

#794 - Scope app middleware to a list of paths
Expose more loopback middleware for require