Add an authorization callback instead of (or along with) herokaiOnlyHandler

[jacobian]

It'd more flexible to have an authorization callback function that decides if an authorized user is allowed (rather than the hardcoded herokaiOnlyHandler).

So for example:

app.use(bouncer({
  oAuthClientID      : 'client-id',
  oAuthClientSecret  : 'client-secret',
  encryptionSecret   : 'abcd1234abcd1234',
  authCallback: function(user) { return /@example\.com$/.test(user.email); }
}));

See also the change to heroku-bouncer-python and my PR for heroku-bouncer.

I'll try to submit a PR for this, but I'm an express n00b so it might take me a bit :)

[jacobian]

Hey, I wrote some Javascript: #21