WIP: Only login if not already authenticated

Calling login here calls identity.request to be called, which in turn
eventually results in the onlogin callback running.

The onlogin callback is not currently idempotent (and it isn't trivial
to make it so) so this results in errors being thrown by Annotator.

Fixes #1611.

I'm not actually terribly happy with this fix. It's the smallest fix we can make that solves the problem, but it took me about 3 hours to work out how the login and authentication components on the frontend work, with lots and lots of bothering @aron. Of course, a large part of this is my lack of familiarity with the code, Angular, etc. But I think some part of it is that this code (specifically, the interplay of the app controller, auth controller, auth page controller, session provider, identity provider, annotator, and angular templates for the app and auth components) is staggeringly complicated, in ways that I can't believe it needs to be.

In particular, I note that it's almost certain this bug would not have been introduced (by @aron in 561d3d4) if the line that currently reads `if plugins.Auth is undefined` had read `if not user` or `if not user.loggedIn`.

Please don't merge this yet, as I want to write some tests to prevent this regressing again, and possibly make the user's logged in state explicit in the app controller rather than using `plugins.Auth is undefined`.