require API_SECRET to be at least 12 characters

This changes causes the server to crash if the API_SECRET environment
variable has a value whose length is less than MIN_PASSPHRASE_LENGTH
characters.
The default MIN_PASSPHRASE_LENGTH is 12, so if the API_SECRET variable
is set but less than 12 characters long, the server will crash.

security/privacy review needed
==============================
The API_SECRET is used as a pass phrase in order to generate a unique
token.

The api routes always try to mount themselves.  Before mounting
sensitive routes that allow modifying the application, the secret
token is required to validate the request, or denied.

When the secret token is absent, the sensitive routes should return
404, and should not be mounted.

This change attempts to eliminate some dangerous middle ground between
having a secured api, having a weakly secured api, believing a secure
api is mounted and working when none is, and not having a secure api
mounted.

The only choices available should be:

* secure api mounted
* secure api not mounted

This change hopefully constrains the possibilities to those two
options.

env.js

@@ -2,6 +2,7 @@
 
 var env = { };
 var crypto = require('crypto');
+var consts = require('./lib/constants');
 // Module to constrain all config and environment parsing to one spot.
 function config ( ) {
 
@@ -26,6 +27,10 @@ function config ( ) {
   env.api_secret = null;
   // if a passphrase was provided, get the hex digest to mint a single token
   if (useSecret) {
+    if (process.env.API_SECRET.length < consts.MIN_PASSPHRASE_LENGTH) {
+      console.error("API_SECRET should be at least", consts.MIN_PASSPHRASE_LENGTH, "characters");
+      process.exit(1);
+    }
     shasum.update(process.env.API_SECRET);
     env.api_secret = shasum.digest('hex');
   }

lib/constants.json

@@ -1,4 +1,5 @@
 {
+  "MIN_PASSPHRASE_LENGTH": 12,
   "HTTP_OK" : 200,
   "HTTP_UNAUTHORIZED" : 401,
   "HTTP_VALIDATION_ERROR" : 422,