EZP-20467: Implement REST server csrf protection for session based auth

This pull request is under construction.

Adds CSRF protection to session based authentication in REST: https://jira.ez.no/browse/EZP-20467.

POST /user/sessions
- [x] add route + controller action
- [x] implement credential check
- [x] 401 error on bad credentials
- [x] 303 if an existing session is provided in headers with the same user
- [x] 409 error if an existing session is provided in headers with a different user
- [x] Update the spec & POST /user/sessions to get rid of POST fields, and replace them with a UserSession struct

DELETE /user/sessions
- [x] add route + controller action
- [x] implement credential check
- [x] 404 error if session doesn't exist

Global
- [x] Verify the CSRF token in every unsafe request.