Ensure that the raw strings are returned.

- Don't need to make_response around the template generated strings; let
  the consumers handle that.
Offload flask and friends onto own module.

- Preparing to override some things.
Create our own identity type

- The id specified in the parent is for the actual id, but in the design
  here we deal in terms of access tokens which then resolve into the
  actual user.  Provide the overrides to make this relationship clear.
Need to figure this out eventually...
Handle the permission denied exception

- Make it somewhat smarter - rely on standard http exceptions
Clean up the initialization arguments

- Truely disable the default session handlers.  It really doesn't look
  like we need them.
Shortcut setting of handler for PermissionDenied