Switch to form based login and adjust session management

Because the session support of atmosphere seems to be conflicting with spring security, it is disabled now. As a consequence, native web sockets must be disabled, too. In some scenarios this will be no brainer because both long-polling and SSE supports directly session and have no problems when using load balancers in front of a cluster.