Moved logged in state to Auth service

Moved most of the loggedIn state and service message to the Auth service
so it can be used globally and not just in the HeaderCtrl. Also fixed a
few bugs:
- User.logout is now using the DELETE method instead of POST
- AuthInterceptor checks both session and local storage for tokens
- AuthInterceptor deletes tokens if 401 is returned
- Auth.logout calls the logout route on the backend