Fixing PHP warning, formatting code, removing unused FCK code.
 Authentication redirection changes.

 - api_not_allowed() now throws an $app->abort() with a 401 error.
 - code from api_protect_course_script() is now a "before" middleware
 attached in the legacy controller.
 - If a user enters a course but he don't have the correct
 permissions then the login page appears (instead of the classic red
 message about the cookies and stuff).