fix(server): Do not set cookies for RP API resources.

* No cookies for /include.js, /navigation and /unload
cleanup(server): Whitelist the requests that cannot have CSRF.
refactor(server): Clean up start.js. Extract http-server.js, https-server.js, fonts.js and logging.js

* Remove complex middleware setup into own modules.
* Remove complex server setup into own modules.
feature(server): Check the validity of a session's user. If invalid, clear session and send user to the `/user` page.
Merge branch 'session-cookie-when'