Implement UserMixin.

User collection and its functionality can be used in several
controllers, and for reusability they should be separated into an
independent mixin.
Change User controller's failure results to `BadRequest`.

Returning `Ok` for failure cases doesn't make sense. They're changed to
`BadRequest` with a useful JSON body.
Change logout handler response body to JSON format.

If we use JSON format for the handler, we can get not only a message,
but also a username from the result. It also fits more to response
convention.
Implement user login handler.

Until now a user's password hasn't been checked for login. This patch
implements the login functionality including checking a username and
password.
Implementing testcase for User and Session controllers.

Add testcases and helpers to write a testcase into
ApplicationSpec.scala.