interface winston logging better, use the Console transport when running in the dev harness rather than manually logging to console (yay for colorized output)

rename 'log_path' configuration variable to 'var_path', as now it will be the path to all files created at runtime.  issue #172

find instances of console.log() and send them to the logger instead, when running under dev harness also route to console.  issue #169

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.