holy shit session timeouts

this rather humongous change does a couple of things:
- editable user settings for session timeouts
- add a REST API access log (for debugging the damn thing)
- on 401 in the ajax request, we now redirect to "/"
- periodic ajax requests no longer prolong the session (this is the worst change really)
- a lot of stuff around passing the stupid timeout value and unit around the templates

fixes Graylog2/graylog2-server#405