WIP: installed a dummy custom tool, which will become the htaccess tool eventually.
Removed weird "self.app" hack; replaced with better global cpserver variable.
Refactored URL analysis into a before_handler tool.
Made 404 case consistent with others.
Prepared copies of the request and disk paths for use by the auth before_handler.
Finished refactor of default handler, but had to keep page-reload hack in.  Authentication seems to be working now.
Merge branch 'htaccess-tool'

Closes #173.