backend: significantly fix incoming-data checks

1) Use a single structure, for simplicy and because keys are not
   guaranteed to be sorted in JavaScript objects.

2) Simplify hasValidKeys impl.

3) Loop over the new object keys and refuse the update if there
   are unknown fields.
login_once: return 500 if the token is invalid

While there, restructure the code to avoid an unnecessary else branch.
saveUsers should not deal with request/response

The backend, in fact, should be agnostic with respect to the
current request and response.

So, refactor the code such that saveUsers invokes a callback
when it is done, receiving the `error' parameter.
login_once: add link to login page
Merge branch 'fixes'