Moving ACL core into its own module structure.
A method just to get users.

- Also call that method where applicable.
User and session management

- Don't trust the cookies.  By default, the timestamp at which the user
  logged in at will be tracked on the server, such that the session can
  be validated on the server side and be revoked at will.
- This of course complicated all the other parts as the methods related
  to the session variables are affected.
- New methods are created to make use of this new design.
- Added a reference user representation class.
- Beginnings of user management.
A more refined group checking (and tests)

- Finished the decorator based checks for groups.
- Have all the methods use the user object and check against the login
  attribute.
- Moved the flask helper methods from the user view into acl flask sub-
  module.
Ensure user groups are also returned as objects.

- In the sql based acl module.
Action column on the user listing.
A way to specify initial setup/admin user.
User edit method.
Front end for user add/edit.
Apply bootstrap classes to flashed messages.