User session system

[schneijan]

Removes the previous http-auth-based login system in favor of a session-based system. Core features:

• On login, user sessions with unique session IDs are generated and stored in the MongoDB
• No session state is kept on the server, instead everything is stored in the MongoDB ("stateless")
• For performance reasons, a local cache on server remembers session IDs and associated users for a TTL of one minute
• MongoDB repository and local cache are updated accordingly on logout of a user
• Sessions expire automatically seven days after creation
• Users with missing or invalid sessions are redirected to the login page
• Username and password do not need to be sent with every server request anymore

Closes #571

[schneijan]

Fixed issue with non-https cookies.

[schneijan]

The API wiki page now describes how authentication works when using the REST API directly.