fix(webapps/login): improve error messages on no app access

- The inability to access an app (due to missing credentials) gets
properly
  signaled via HTTP 403 (FORBIDDEN)
- The login failed method reflects the matter, too
- The internals of the security filter are changed to report the fact,
  whether a user is authorized or not to be able to properly
  handle an authentication error

Related to CAM-1059
refactor(authentication): replace cookie-auth with X-Authenticated header

- instead of relying on a client-side cookie we now rely on a number of
  X-Authenticated headers that contain the currently authenticated user.

- whenever the header has changed (is added or removed) in between
  successive requests, a change in the server-side login state gets
  apparent. The client application will reflect that change in the UI.

- Serverside authentication has a mechanism now to distinguish
  logged-in but forbidden (403) from unauthorized (401) requests.
  This is achieved via the
  org.camunda.bpm.webapp.impl.security.filter.Authorization class
  that contains request relevant authorization data.

- A few test cases test the basic login behavior. More stuff must happen
  here though.

Related to CAM-1059
Merge branch 'master' of github.com:camunda/camunda-bpm-platform
fix(messages): improve task complete / process start error message

Related to CAM-1059
fix(admin/messages): add failure notices for user / group add / create

Related to CAM-1059