Authentication updates

Fixed authentication to allow the client to authenticate using a
JWT.
Refactored authentication strategies, added error catching.
Rewrote and fixed changePassword API (no longer requires a JWT in
the header, now creates a JWT and sends to the client just like the
login API does).
Added "proxy_host" and "proxy_port" config options.
Removed "sid" from VM session model (now JWTs can be reused over
and over again; instead relies on unique username).