Make session expiry less arsey

closes #2171
- added authentication middleware
- removed authentication from routes
- moved authentication before CSRF validation
- moved caching rules before authentication
- changed/added test
Merge pull request #2190 from sebgie/issue#2171

Make session expiry less arsey