make access control of routes/states more flexible

By introducing an `authorizationRequiredHandler` and an `accessDeniedHandler`, reaction to these two types of access control violations is more flexible.
`authCheck` complements `hasPermission` by a more flexible mechanism for access-checking of routes/states.
I cleaned up some other route/state transitions when logging in/out.

As a result, the login form could now be displayed in a popup (no dedicated login state required anymore), as well as a notification about access denial.
Logging in and out does not necessarily change the route/state anymore (if access rights allow that) but just reload the current state.

What do you think?