Move /_session and /_browserid to underneath database in URL hierarchy

At top-level, they can no longer find user documents because those live
in databases, of which there can now be more than one.
(Yes, this breaks CouchDB compatibility with /_session.)