Logout and Deauthorize via Websocket

In order to prevent CSRF attacks on the old ```/logout``` and ```/deauthorize``` handlers, remove them and replace them with messages sent via the WebSocket.

See ```doc/protocol.md``` for documentation on the ```logout``` control command.

We also fix a few other bugs (in separate commits) along the way.