Update models to take advantage of container < slot hierarchy
Add login API

There is a possible issue here where both api and html routes share the
same controller, because the reverse routes can only map to one.
Whether this is a problem depends on where the JS reverse routes come
from.  If these need to be correct (or we want to eliminate the
warning), we should use a common class.

Play's routing package structure is still annoying.
Merge remote-tracking branch 'remotes/origin/master' into angular

Conflicts:
	conf/routes
authService; login api routes; superuser (with bug); has-auth directive to show/hide elements