Fixed most recent session in device report
Renamed `swid_log` url to `log`
Require login for swid views and statistics
Added a `fields` param to all API endpoints

The API now allows a new `fields` parameter that can filter returned
fields per document.

The fields need to be comma separated, without any spaces.

- Correct: `fields=id,url,packageName`
- Wrong: `fields=id&fields=url`
- Wrong: `fields=id, url`

Nested entities can be shown or hidden, but their fields cannot be
filtered.