use $this->request in favour of creating a new

Resolves an issue where $this->cookies->set didn't
send the cookies back to the client since the cookies
where set on $this->request but json responses created
a new HttpResponse
add crypt for use with cookies
add unauthorized action to error controller
use unauthorized instead of forbidden
fix sessionauthenticator logic for remembered login
refine authentication interface and classes