Avoid global usersettings

[aspic]

Have a bad feeling about setting userSettings in the node-express-auth handler, and then re-using that global variable for a specific user. Mitigates this by:

• Extracting getting user settings from username/password into it's own module ProxyAuthorizer
• Uses that module for authorizing in myAuthorizer
• Re-uses the module when getting specific user settings in processRequest (access the req.auth header there)

This also made testing simpler, and we can now test the default config files directly, instead of copying them into test scope.