Move login into the application bundle

A longstanding UX issue with the application bundle is that users would need to leave the bundle to create a session with the remote server. This pull request moves auth onto an AJAX endpoint . The only downside is the user will not know if their account is locked since the remote server currently does not display any UI messages. The content server needs an update before it will permit AJAX auth. Future versions of this "app" should look to implement Mozilla Persona or remote storage.