Allow using http auth to login when a deployment is private mode

* This makes all request allow login via http auth
* Adds Auth::http_auth_login() and Auth::http_auth_prompt_login() to Auth library
Improving tag media API calls

* Fix error thrown when tagging media to an existing report via the API
* Add incident id existence check when tagging a media to an existing incident via the API
* Refactor tag media to make use of inherited method for showing messages
* Switch to using ORM for querying the location id
Only reset session for non-ajax API requests #791

* Avoids log out issues when grabbing things via ajax (ie. checkins)
* But prevents CSRF by resetting the session.
* Stil vulnerable with XSS but they could grab the CSRF token anyway.
Remove duplicated code for HTTP Auth login
Avoid popping login box for ajax requests w/o auth
MY_Controller - grab user after login checks
Merge branch 'http-auth-api-fixes' into develop

Closes #1000