Use passport-http for API authentication

This allows both legacy and new accounts to authenticate over the API.
Prompt user to upgrade their legacy account

When a legacy account is detected take the user to an upgrade page which
allows them to associate their legacy instance with a new-style account.
Fix auth tests

Make sure the login route redirects upon success and the logout route
exists.