Spectator mode

[ChristophNiehoff]

This pull request introduces a spectator mode, i.e. a link to a readonly view of the game indented for a moderator.

The idea behind this is described in this documentation: If the playerID is undefined then boardgame.io defines a readonly view. The "player" of this view cannot participate in the game.

For the spectator mode, the following changes where added:

• When creating a new game, a dedicated set of spectator credentials are generated on the server, that are later used to secure API requests from the spectator
• A spectator link is created along with the normal player links (The "Copy All" button on the create page does not contain the spectator link)
• When entering the spectator link a boardgame client with playerID=undefined is generated in the react app
• The board does not render player specific components (i.e. the card deck)
• API requests are authenticated using the spectator credentials
• On the server, a koajs middleware checks for correct player credentials or correct spectator credentials

Resolves #74

[ghost91-]

Looks good! I just added a minor question.

On a side note, it probably makes sense to start using a proper logger instead of just console at some point. I'll create an issue for that.

[ghost91-]

What kind of error cases can be caught here? Is it only actual errors that represent bugs, or can the user also cause errors here by incorrectly using the software?

[ChristophNiehoff]

I believe it is both. E.g. a user could send a request without Authorization header. Then credentials === undefined and calling credentials.name would raise an exception.
But yes, by just using the software (correctly or incorrectly) one should not run into this.

[ghost91-]

If this is the case, I think we should differentiate the cases. Problems resulting from users incorrectly using the software should not be logged on the error level. Only actual errors in the software that require intervention / bugfixing should be logged in that level.

[ChristophNiehoff]

Agreed. Changed it such that user-errors are logged on log-level and unexpected errors are logged on error-level.