add support for protected sites

https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/
https://gock.net/blog/2020/nginx-subrequest-authentication-server/
https://github.com/andygock/auth-server

package.json

@@ -24,6 +24,7 @@
     "connect": "^3.7.0",
     "connect-lastmile": "^2.0.0",
     "connect-timeout": "^1.9.0",
+    "cookie-parser": "^1.4.5",
     "cookie-session": "^1.4.0",
     "cron": "^1.8.2",
     "db-migrate": "^0.11.11",
@@ -36,6 +37,7 @@
     "ipaddr.js": "^2.0.0",
     "js-yaml": "^3.14.0",
     "json": "^9.0.6",
+    "jsonwebtoken": "^8.5.1",
     "ldapjs": "^2.2.0",
     "lodash": "^4.17.20",
     "lodash.chunk": "^4.2.0",
@@ -44,6 +46,7 @@
     "moment-timezone": "^0.5.31",
     "morgan": "^1.10.0",
     "multiparty": "^4.2.2",
+    "mustache-express": "^1.3.0",
     "mysql": "^2.18.1",
     "nodemailer": "^6.4.11",
     "nodemailer-smtp-transport": "^2.7.4",