rewrite: push login modal to the front page, don't allow anonymous

usage.

src/controllers/user.js

@@ -31,7 +31,6 @@ var NO_USER_FOUND = {err: "No user found."};
   beforeEach auth interceptor
 */
 
-
 api.auth = function(req, res, next) {
   var token, uid;
   uid = req.headers['x-api-user'];
@@ -53,6 +52,7 @@ api.auth = function(req, res, next) {
     }
     res.locals.wasModified = +user._v !== +req.query._v;
     res.locals.user = user;
+    req.session.userId = user._id;
     return next();
   });
 };

src/middleware.js

@@ -5,8 +5,8 @@ module.exports = function(req, res, next) {
 
   // show them the splash page if they're not logged in
   var isStatic = req.url.split('/')[1] == 'static';
-//  if (!isStatic && !req.headers['x-api-user'] && !req.headers['x-api-key'] && req.headers.accept != 'application/json')
-//    return res.redirect('/static/front')
+  if (req.url == '/' && !req.headers['x-api-user'] && !req.headers['x-api-key'] && !(req.session && req.session.userId))
+    return res.redirect('/static/front')
 
   res.locals.habitrpg  = res.locals.habitrpg || {}
   _.defaults(res.locals.habitrpg, {
@@ -20,7 +20,6 @@ module.exports = function(req, res, next) {
   res.header("Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,HEAD,DELETE");
   res.header("Access-Control-Allow-Headers", "Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key");
 
-  //wtf is this for?
   if (req.method === 'OPTIONS') {
     return res.send(200);
   }

src/routes/pages.js

@@ -19,6 +19,11 @@ router.get('/partials/options', function(req, res) {
   res.render('options');
 });
 
+router.get('/logout', function(req, res) {
+  delete req.session.userId;
+  res.redirect('/');
+})
+
 // -------- Marketing --------
 
 router.get('/splash.html', function(req, res) {

src/server.js

@@ -34,6 +34,8 @@ app.use(express.logger("dev"));
 app.use(express.bodyParser());
 app.use(require('connect-assets')());
 app.use(express.methodOverride());
+app.use(express.cookieParser(nconf.get('SESSION_SECRET')));
+app.use(express.session());
 app.use(require('./middleware'));
 app.use(app.router);
 app.use(express['static'](path.join(__dirname, "/../public")));
@@ -71,7 +73,6 @@ module.exports = server;
  #  .use(express.methodOverride())
  #  # Uncomment and supply secret to add Derby session handling
  #  # Derby session middleware creates req.session and socket.io sessions
- #  .use(express.cookieParser())
  #  .use(store.sessionMiddleware
  #    secret: process.env.SESSION_SECRET || 'YOUR SECRET HERE'
  #    cookie: { maxAge: TWO_WEEKS } # defaults to 2 weeks? aka, can delete this line?