don't create a session for non-authenticated requests

* this required quite a bit of hacking, including replacing the Session
* Middleware with our own and temporarily storing the csrf token in a
* cookie. now there should be no database hits for unauthed users.
make sure session cookie gets destroyed on logout
improved token error handling (including ui)
typo
give user a max of 5min to verify the token
reduced font size of graph labels
show a tooltip when highlighting graph points
remove duplicate call (bind_events already called after_render)
pass the correct div to the graph
draw tooltip relative to div.graph
hide the tooltip on mouseout; refactor