Avoid double slashes after the base url
Add auth.py and HybridAuthenticationPolicy

This is needed because API requests do not carry the session cookie
if the api is served from a separate subdomain. Unfortunately, the
included SessionAuthenticationPolicy will not bother to check the
callback if there is no so-called "unauthenticated_userid" (retrieved
from the session storage). Therefore, we need to derive a custom
policy that knows to check the auth token when determining the
effective principals.