Home page refactor.

The home page was moved from coursepage to the Angular module "home".

Also tried to get Flask-Restless to play well with not exposing the
user's password hash. Unfortunately, all the different ways of excluding
fields or only including fields seem to fail when doing queries on
relations (e.g.: /users/1/courses). The password hash is hidden on
normal users queries but when you ask for something like a user's
courses, it pops back up. This means that we might have to abandon
Flask-Restless.
Switch authorization lib from principal to bouncer

Now using Flask-Bouncer for authorization rather than Flask-Principal.
The revamped scheme I came up with for authorization in Flask-Principal
turns out to be very similar to how Flask-Bouncer is structured (e.g.:
action name such as READ, a model name, and a model id to identify a
permission). So it was easier to just use Flask-Bouncer.

Note that two libraries are both problematic in that there seems to be
no easy way to make them work in blueprints and has to live in the main
app module.

Permissions are defined in the new authorization.py module in a
function. The function is called by the app module during bouncer's
setup.

The Users object now tracks last seen based on last login and last
logout. Note that these are probably insufficient since the time between
login and logout may be quite a while.

Don't feel like going through the Users module's old code to see what
can still be used yet, so I've just commented them out for now.

Note, also abandoned using Flask-Restless for the Users model. To
properly control hiding the password hash, I'm using Flask-Restless's
helper methods to generate the JSON manually instead of the automatic
setup.