hardened configuration

- moved env rewrite + dotenv code to single location
- fixed bug with system flag on user

services/env.js

@@ -0,0 +1,11 @@
+// Perform rewrites to the runtime environment variables based on the contents
+// of the process.env.REWRITE_ENV if it exists. This is done here as it is the
+// entrypoint for the entire applications configuration.
+require('env-rewrite').rewrite();
+
+if (process.env.NODE_ENV !== 'test') {
+
+  // Apply all the configuration provided in the .env file if it isn't already
+  // in the environment.
+  require('dotenv').config();
+}