Don't resolve the updater in the promise store

Besides potentially delaying the websocket connection unnecessarily,
this was causing a subtle race condition wherein the stream would
miss a digest and appear blank. Reasons are unclear, and may hide
dragons.
Squash session and profile; auth and account

These resources are one resource on the backend. The pattern of
preserving object identity for the session response is unnecessary.
The identity module now listens for events on the root scope instead
of watching the session. The auth controller publishes the session
change directly and the auth directive is completely removed. Timeout
is handled in the controller.

Include the account and auth forms via a macro in the blocks template
so that all the dialogs can be overridden together and get rid of the
``show-account`` directive.
Decouple identity and authentication

Pull the identity service out of the auth module so that it can be
used separately. Wrap the service in a provider with properties
that applications can configure to adapt to different authentication
environments. These properties provide a way to configure injected
functions that the identity service can invoke in order to fulfill
requests from client applications for authorization grants without
tying the identity service itself to particular implementations of
sessions or authentication.
Move the account controller into the auth module
Add ngdocs to the session module
Move assets.yaml into package at h:assets.yaml

Make the asset definitions accessible from dependent projects via
asset spec. This makes overriding bundles easy for custom deployments.
Remove auth bundles from app bundle

They are already required separately in the layout.