major rework to the user authentication mechanism, first users system page

* previously the authenticated user was store in play's Cache, which broke when reloading the server (e.g. during development)
* now the user's credentials are stored in the session cookie, but are encrypted with Blowfish cipher using the app's secret
* on every page load the user is loaded from the server, previously it was cached
* an initial, read only version of the user system page is included
deprecate user id, use getName instead

the user id is only internal to the server, the unique key is the human readable username
 also catch NPE in to_user partial