Implement auth scheme for regular browsers

In case the app cannot access API, it will force login using a redirect.
After redirect is finished, it will pass keys needed as query
parameters. These keys can then be used to fetch the data by passing
them via headers (no cookies needed).

The primary advantage of this scheme is that now the static side (ie.
www/) may be run "as is" without needing to set up a server. The scheme
isn't probably the safest possible (keys can be MITM'd etc.). It could
make sense to run it over SSL etc.

It might make sense to move PhoneGap to this scheme as well but that
remains to be investigated.