Feature/login

This PR straightforwardly implements changes discussed in issue 231.

GET /v1/session  for logged in uses returns the contributor object with LDAP roles (same as POST /v1/sessino)

POST /v1/login is now POST /v1/session

GET /v1/logout is now DELETE /v1/session  


Also fixes issue #241 that Mike gave to me today.

This is obviously a breaking change -- we will want to synchronize with browser before merge.