Schema updates and login development

PHP code base now has a working login back-end (no GUI yet) which is
capable of three actions:

-Logging in a user based on a username/password combination, including
the MD5-to-bcrypt transition mentioned in the notes in the
new_schema.sql file and creation of a cookie-based session (128-bit key
generated using a cryptographically secure PRNG, see crypto_random.php).
-Logging out, including destruction of session (both cookie in the
user's browser and the entry in the database).
-Resuming from a cookie-based session and updating the `last` and
`last_ip` fields in the database for that session while doing so.

It should be noted that due to the fact session keys are generated in a
secure way (cryptographically secure PRNG) they are not guaranteed to be
unique.  There's a very small chance (1 in 2^128) that one key will be
identical to another.  In this case the app issues an HTTP 500 error.

Perhaps more graceful handling (such as trying to generate another key?)
can be added in the future, but the odds of this happening are
astronomically low.  2^128 is more than the number of molecules in all
the matter on/in planet Earth.  Besides which the error is handled
gracefully -- with a 500 error -- and doesn't result in any sort of data
corruption et cetera.

Note that this "problem" will apply to API keys as well, as they will be
generated with a cryptographically secure PRNG and are 128-bits, unless
something changes.

The new_schema.sql file has been updated, adding a flag for making a
user into an administrator and adding a test user.  Also misc.
notes/questions were added.

There are quite a few unanswered questions about the data requirements
in new_schema.sql.  Would be nice to get those ironed out.  Waiting on
Jason or someone with more knowledge of the requirements on this one.