squash mongo injection work

api database queries: generic findOne with _id condition to findById

findById returns (possibly) single item instead of (possible) array

sloppy middleware implementation

simplify middleware, don't use extended query parsing

test

slightly more complex test

one line

be synchronous; request test

custom response message with more complete request/response test

fix spacing
match style
comply with config change to convict
fix all password reset test URLs to point to /forgot not /forget
remove useless response param
Merge pull request #68 from hulbert/mongo-injection

Reduce risk of MongoDB query selector attacks