Extend authentication to properly handle page refreshes

When navigating to a route we want to verify with the server whether the user is still logged in because in case of a full page refresh any client-side login state is reset. The implementation starts with a simple GET sessions API that returns the currently logged on user if there is one or returns a 401 unauthorised otherwise. On the client side we use a resolve property on the authenticated routes (that means all routes except the login page) to call the new API. Then in a $http error interceptor we catch 401s and redirect to the login page.