JSON API; stylistic changes

Added a very basic framework for writing JSON API endpoints; migrated `auth` to use it. It needs further testing, but `/login` and `/logout` work as before.

Moved code around so that it's easier to read.

PS: I don't have write permissions on the csesoc repo.