Get rid of global app/weights state and simplify login logic

Login handling was scattered around templating code.  Get rid of those
complications and rely on automatic login screen rendering when
receiving HTTP 403 status from AJAX calls.
Add REST interface for listing & adding notes
Add client-side support for adding & removing notes