Add security

This is achieved by reference to a new modular library called 'entrance'
which provides support for cookie and HTTP basic-authentication
policies.

All API resources for both the data-sets and the map load/save are
protected via HTTP basic-authentication but accessible also with session cookies.

User interface routes are protected with a cookie-based session
mechanism. Entrance uses protocols to allow for the user-registry and
session store to be independently provided.

Currently there is only a primitive read-only map-based user-store. A
set of users can be specified in the configuration, which will override
a set of hard-coded users.

Test data is loaded through the authentication mechanism by taking the
credentials of a given user. This test data loader should be disabled in
the production system.