Authentication work

Long overdue - updates to `auth` and therefore also to `Resource`.

`auth` is now really checking if someone is logged in - and notifies us when the user isn't. It can also recover from such a scenario: When the user logs in in another window/tab and tries to do something like a save, `auth` will now that a new valid login session is present.

`auth` includes a stand-in object that just let's everything through in case not authentication was requested by a conf file.

This is all nicely hidden in the `auth` code, after lots of refactoring the changes to `Resource` are very minor. As valid duck-types are present, `Resource` can just call `auth` functions and not care about anything else.