Move DOMjudge-native checking of username/password to separate function.
Put roles query into separate function
Refactor API to single endpoint and use of DOMjudge permissions system

Because we now have global users and permissions in DOMjudge, move
the api to a single endpoint www/api/, doing away with www/jury/api/.
The API will now use DOMjudge's roles to decide who may access it.
An API function can define which roles may access it; define none
to make it public; admin may access any.

Change specification of the handler from using rewrites to using
path_info. This means we can make it work with a single Alias line
in Apache and can do away with .htaccess files.

Authentication happens in one of two ways: firstly, based on an
already authenticated user. If that's not the case, the caller can
pass a username and password via HTTP Basic Auth which will be
checked against DOMjudge database (regardless of configured auth
scheme).