Abstract app session details

This commit abstracts out the app session and authentication details
from views and controllers that don't need to know about them. The new
classes are AppSession which securely stores the user and auth token
data, Authenticator which makes requests to the api for user
authentication and creation, and FacebookHandler which holds the logic
for facebook session opening and error handling. All other files were
adapted to use these new classes.