No threading or blocking in CockpitAuth

**Depends on: #556**

To do this we treat login separately from loading cookies. This was
already the case, but we make it clearer.
    
Actual PAM authentication happens in cockpit-session, so we simply
get notified when it completes and then complete the async login
web response.
    
There's room to make this cleaner, but will wait until we get GSSAPI
authentication in the mix before refactoring it further.