Refucktoring & auth fix

  * Moved api-related controllers under /api
  * Extract MovieClub.BaseView and MovieClub.CompositeView

    Use CompositeView for view containing (and managing) subviews.
    Use `regisetSubview(subview)` when creating subviews and `removeSubviews()` in
      `leave()`
    Prefer `renderSubview(subview, selector)` to render subviews, it
      uses `setElement()` on subview, which triggers `delegateEvents()`,
      thus event bindings are preserved

  * Add some logging

    To enable rendering-related logging, set
      `MovieClub.renderLoggingEnabled` to true
    To enable session-related logging, set
      `MovieClub.sessionLoggingEnabled` to true

  * Update CSRF token on login & logout