Qallowall

This adds basic functionality to let anonymous users view the subpages of `/queue`, but not actually queue.
It also fixes a bug with `js-vendor` not being allowed for all.
The redirect to force a CAS login is rather ugly, but I haven't found a better way atm.
I had problems with getting `principal.username` since that won't exist if you are not logged in, so I added a check for it to stop thymeleaf from refusing to render invalid object fields.
Also we might consider to add a GUEST role of some sort to not break other things.

This implementation will probably have to change, so I request feedback on it.