Implement client side authentication.

Now there is only one single page app which handles also the authentication
Notable changes:
- the manager page is now plain HTML and does not get rendered anymore by kiwi
- the login page becomes a partial with its own controller
- a http interceptor broadcasts error events on 401 errors (unauthorized)
- a new service (AuthService) listens on this error events and handles authorization state (and does login/logout)
- the login route changes to /api/login (POST) which wants username and password and returns the user object
- there is a new /api/ping route (GET) for the app to determine its auth state
- the user object is stored in a cookie store to survive browser restarts
- user data is set via cookie ('USERDATA')
- the CSRF cookie is now restricted to the /manager route