avoid entity api functions for loading current user.

this messes with bootstrap.
stop including password encoder in user class.
remove session from globals.
restructure bootstrap and request handlers.

The Drupal bootstrap class only assures that include files are loaded. The actual Drupal bootstrapping is kept to a minimum, and the BootstrapListener class does its best to align Drupal with Symfony request events.