Break auth from app

Changes the session service to unwrap the model from the response, allowing the session resource instance to be placed directly on the scope for watching, avoiding an unnecessary copy and ensuring that extra data (csrf token, flash message queue, etc) aren't submitted with the auth forms.

Breaks out the `AuthController` into its own file with a corresponding directive and tests.