authentication

Enable authentication.

Signed-off-by: ShaoHe Feng <shaohef@linux.vnet.ibm.com>
Signed-off-by: Hongliang Wang <hlwang@linux.vnet.ibm.com>
Enable REST API

This patch depends on:
 - [PATCH 0/3 v4] SSL Support
 - [PATCH V2] A module to check the pam authenticate

With SSL and PAM authentication support present, we are now ready to
protect our website with a login screen.  Here's how it works:

We enable a new tool 'kimchiauth' on most of the content served by
kimchi.  This includes the REST API and UI pages.  The login page is the
only thing that requires no authentication.  For now, some JS and CSS
are also allowed without a login (this allows the login page to access
some needed resources).

The kimchiauth tool checks if there is an active session before serving
the content.  If there is, then the content is served as normal.  If
there is not then the following happens:  If the REST API is being
used, HTTP Basic Auth headers are checked.  If present, the provided
credentials are used to attempt a login.  If this works, the content is
sent as normal.  If the UI is being used, the login page is displayed.
When the user enters their credentials on the login page, a call is made
to /login with the given credentials.  On the server, /login will
attempt to authenticate with the supplied credentials.  If successful, a
session is established and the client will reload the original URL.

This scheme has some notable properties:
 - HTTP Basic Auth can be used by REST API consumers.  It's easier than
   trying to use /login.
 - The UI will not use Basic Auth.  This allows for a secure logout
   since the browser will not be caching any credentials.
 - The established session can be used to store user preferences (such
   as preferred language).

Signed-off-by: Adam Litke <agl@linux.vnet.ibm.com>
Enable Cookie Manipulating in Client Side

Enable cookie manipulating. kimchi.cookie will allow developer set/get,
remove a cookie key/value pair.

Signed-off-by: Hongliang Wang <hlwang@linux.vnet.ibm.com>
Enable UI

By using a pop-up log-in window, we're able to provide a consistent way
of authentication for UI in several scenarios:
  1) User visit http://kimchi:port/#templates
    ==> Load main UI
    ==> Load Templates UI
    ==> Send request for listing templates
    ==> Server returns 401
    ==> Client fetch log-in window UI
    ==> User types user name and password
    ==> Authenticated and server returns 200
    ==> Continue to send request for listing templates
  2) User logged in but session timed out and he tries to do operations
    ==> The operations cause client to send request for some resources
    ==> Server returns 401
    ==> Client fetch and show log-in window
    ==> User types user name and password
    ==> Authenticated and server returns 200
    ==> Continue to send previous request

  Notice that the last 6 steps are processed with the exact same logic.

  This patch enables UI authentication mainly by Ajax.

  Test cases passed:
  a) Enter an invalid URL like: /#invalid
     ==> Show 404 Not Found page and a button guiding to homepage
  b) Enter valid URL or open page from bookmark
     ==> Load base UI, load specified page, and show log-in window
  c) Submit log-in form leaving username or password blank
     ==> Tell the field is required
  d) Submit log-in form with wrong username or password
     ==> Tell the data is wrong according to response code
  e) Submit log-in form with correct username and password
     ==> Disable log-in button and waiting for response;
         Load page content
  f) When session times out, switching page tab
     ==> Show log-in window; log in; load switched page
  g) When session times out, create template
     ==> Show log-in window; log in; stay in template creating window
  h) Refresh the page
     ==> (Session alive) Load page and show username
     or  (Session timed out) Show log-in window and hide username
  i) Access RESTful APIs via tool (REST Console for Chrome)
     ==> Basic Authentication

Signed-off-by: Hongliang Wang <hlwang@linux.vnet.ibm.com>