introduce authentication required handler

This handler is invoked if a route/state is activated that requires an authenticated user but there is none. It defaults to a handler that prevents the route/state change to happen and transitions to the login route/state.
introduce access denied handler

This handler is invoked if a route/state is activated that the current user does not have access to. It defaults to a handler that transitions to the default route/state.
added authCheck to routes/states

authCheck can be added as parameter to a route/state. It must be a function that is passed the current user and (in case of UI router the params of the state to be checked) and that returns true of access to this state is allowed for the passed user or false if access to this state should be denied to the passed user.
documented access-controlling routes/states

- public vs. non-public routes and authenticationRequiredHandler
- required permission and accessDeniedHandler
- authCheck
reloading route/state after logging in/out

This reevaluates access rights since route/stateChangeStart events are fired again.
Removed transition to default route when activating session and current state is public (since I think it made no sense).
reloading state before broadcasting user.login when logging in
removed reloading of state/route upon login/logout

Now, access checks are just re-performed without a route/state reload in the reset and activate functions.
Furthermore, the route/stateChangeEvent is not passed to the handlers anymore.
checking for authenticated user before executing authCheck
only perform auth check when user is loaded

user being authenticated is not enough, all the attributes need to be loaded and merged into the user object in order to have them available for arbitrary checks in authCheck
Merge pull request #3 from jack-kerouac/master

make access control of routes/states more flexible