AuthCore more restrictive - now globally protects all module paths

AuthCore now disallows all requests to any rapidapp module path to
non-authenticated users/sessions, which is the more intuitive/expected
default behavior. Individual modules thus don't need to worry about
permissions for the non-authenticated case per default. For an exception
(i.e. to make a given module(s) public) the user needs to override the
method 'is_auth_required_path' in the main application class namespace.
Later on, this may also be exposed as a config param.

This is an API change, although very minor and shouldn't impact any
existing applications. But, this did require changing some of the test
cases, to test for a different kind of access denied response

Also made various improvements to global dispatch logic to properly
handle the case of an alternate module_root_namespace