documented access-controlling routes/states

- public vs. non-public routes and authenticationRequiredHandler
- required permission and accessDeniedHandler
- authCheck
reloading route/state after logging in/out

This reevaluates access rights since route/stateChangeStart events are fired again.
Removed transition to default route when activating session and current state is public (since I think it made no sense).