Refactor authentication filters

Authenticating the user is now default in the application controller,
and the non-authenticated controller actions are listed as exceptions.

This adds some tests for the non-authenticated actions.
Get rid of test/functional

Use test/controllers instead.