Fixed most recent session in device report
Renamed `swid_log` url to `log`
Require login for swid views and statistics
Added a `fields` param to all API endpoints

The API now allows a new `fields` parameter that can filter returned
fields per document.

The fields need to be comma separated, without any spaces.

- Correct: `fields=id,url,packageName`
- Wrong: `fields=id&fields=url`
- Wrong: `fields=id, url`

Nested entities can be shown or hidden, but their fields cannot be
filtered.
Revised SWID inventory
Removed all users and sessions from default db
Switched to custom API permission class

Access to the API is granted in two cases:

- User is an admin (`is_staff=True`)
- User has the `auth.write_access` permission

Otherwise, the user is rejected with a HTTP 401 or HTTP 403 status.
Added CSRF_COOKIE_SECURE to settings.ini
Enabled clickjacking protection
Added paging to potentially large tables
Added dajax wrapper and loading indicators
Moved ajax-utils.js content to common.js
Added error handler proxy to remove ajax indicators on failure
Added version column to regid detail view
Reordered save and delete button in package view
Added matching package link and highlighting to inventory view
Added package name and version column to log view
Avoided multiple ajax requests caused by hashchanged events
Changed default timezone to UTC
Fixed get_sessions_in_range