Composable API handler, support v1 and v2 login.

Some refactoring & restructuring of srvRoot to support the existing Admin.Login API as well as allowing us to introduce a v2 Login API, to be proposed in a followup pull request.
So it looks like this is the mechanism you're using to change what API is being served (changing the value of a.root.MethodFinder).
However, this is
a) Not thread safe (is it?)
b) Goes against the general idea in the rpc package of using ServeFinder to change what API is available.

Which seems a bit strange given the design of the RPC package is to expose exactly the API you're exposing, rather than changing it underneath.