Fix login page for hosting app

Trying to get the login page working on both the hosting app and the
instance app was proving to be a lot of trouble. For the time being just
move the login to the hosting app. This does break guest logins, but
we're going to have to reconsider how they're going to work now we're
switching to site-wide accounts.
Fix logout route and add test

Now we're using cookie based session storage there is no destroy method,
you simply have to assign null to the session to clear it.
Don't show legacy auth failure messages

This can be confusing since the same error is repeated twice. Arguably
this is a bug in passport since it should handle the returned error
messages, but this fix seems to work well for the time being.