EZP-20467: Implement REST server csrf protection for session based auth

This pull request is under construction.

Adds CSRF protection to session based authentication in REST: https://jira.ez.no/browse/EZP-20467.

POST /user/sessions
- [x] add route + controller action
- [x] implement credential check
- [x] 401 error on bad credentials
- [ ] 303 if an existing session is provided in headers with the same user
- [ ] 409 error if an existing session is provided in headers with a different user

DELETE /user/sessions
- [ ] add route + controller action
- [ ] implement credential check
- [ ] 404 error if session doesn't exist

Global
- [x] Verify the CSRF token in every request