Sessions

[m4v15]

We need sessions for the users to be logged in directly to the OTP. Granualar steps are below.

• [x] Route to allow users to register on the OTP /register
• [x] Route to allow users to login on the OTP /login
  • [x] On log in, check username and PW
  • [x] On success, sign JWT with username and user role (scope)
  • [x] Add the JWT to a cookie
• [x] Add middleware to check secure routes
  • [x] get the JWT from the cookie using express-jwt
  • [x] Then check username in JWT exists and get user id
  • [x] Check user.scope matches the scope allowed on the route
  • [x] Test middleware

Most of these have already been addressed in PR #95, we just need to change the JWT from a header to cookie on this line and then use express-jwt to get it from the cookie in this file (I think it defaults to looking in the authorisation header), and then we need to add tests.