Extend model to support multiple isolated sites.

Make sure users and locations are site specific, so users of one site
can not be granted access to some other site.
Return not authorized if user is logged to some other site.
Do not allow cross site whoami calls.
A middleware to associate site id and url with requests.

Use the site from the request everywhere where it is needed instead of
hard-coded SITE_URL configuration variable. At the moment, the
middleware sets site_id and url to be equal to SITE_URL from
settings.py
Debug when log assertion verification fails.
Allow SITE_URL to be passed by frontend server.
Store uuid in UserExtras.uuid not in User.username.

username is limited by Django to 30 characters, sqllite does not validate
this, but postgres fails when 36 chars uuid is stored in the username.
Clear the loop that generates user name.
For efficiency, pass the User object not the user uuid to can_access().

Caller of can_access() should already have the User object, so passing
uuid results in an unnecesarry lookup.
Decrease username length.
Code cleanup: replace 'has_key' with 'in'.
Use aboslute paths to load static resources.
Add missing src type.
Use abolute path in js tests.
An option to return HTML documents from auth request.

This is useful for servers that can pass auth request result body to
client (Rack can do it, nginx auth_request can not).
Simplify the constructor of SiteMiddleware.

Make sure SITE_URL and SITE_URL_FROM_FRONT_END are not set together.
Set cookie 'secure' flag if a site is served over HTTPS.

Refactor a way in which cookie 'httponly' flag is set.
Do not create initial admin user if SITE_URL is not given.
Do not read static assets on each request.
Remove unused decorator.