Move authentication routines into a separate module.

This moves all the authentication- and session-related code into
a submodule.  It also makes three changes to how auth is done:

  * use HMAC-signed session tokens instead of UUIDs stored in memory
  * configure browserid mocking in the config file instead of from
    a command-line argument
  * match asserted user/app against the URL and give a permission error
    if they do not match