Use namespace-wide middleware to handle authentication

Instead of per-route
Add API link to backend
Redirect away from login page when user is already logged in
Remove `x-powered-by` header and tidy Express view setting