support ssl with turbines, merge callbacks server

the callbacks server is now part of the main web server, protected with
basic auth. this is to simplify routing; in simple setups (e.g. a PaaS),
you may only get one port to listen on, and it'll be public.

an external callbacks URL, which also specifies http or https (which
implies ws or wss for websockets), is now specified via a flag. a basic
auth password for these endpoints should also be specified.
check for basic auth config or -dev to disable