Abstract app session details

This commit abstracts out the app session and authentication details from
views and controllers that don't need to know about them. The new classes are
AppSession which securely stores the user and auth token data, Authenticator
which makes requests to the api for user authentication and creation, and
FacebookHandler which holds the logic for facebook session opening and error
handling. All other files were adapted to use these new classes.