…oute

And add tests around isAuthorized() while we are at it.

I note that the API spec prefers `errorMessage` to `message`, but I
proposed in Jira that we modify the spec instead.

getAuth is going to throw an Unauthorized error. If we don't care about
authentication, we send the request anyway.

Tests would be nice to maintain this behavior.

Let's be a bit more careful here and throw errors other than
"Unauthorized", so we don't accidentally swallow something.

for the proxy to MarkLogic. Both are viable prefixes for MarkLogic.

…ntage of built in features ie. rolling/refreshing sessions and expiration to replace custom code

…tore the hashed username:realm:password in the session securely

#25: added initial implementation of default route for rest extensions

#31: added default ping route, including call to backend ping extension

…re-api

Various robustness updates

Feature/26 crud actions