Support API signing instead of passwords

Passwords can still be provided if the request was signed
via a "user-less" key, otherwise the API requests are bound to the
user specified in the API credential

Also, removes "api logging" as part of a general cleanup

Note that testing also uncovered an issues with sessions not always
existing. This was fixed by first checking for the session (see
treemap/util.py:52)
Move a couple of static endpoints to the "new style" decorators
Torch the geocoder endpoint

Both mobile apps use other geocoders
Merge pull request #1154 from OpenTreeMap/topic/api-signing

Support API signing instead of passwords