Add basic access control

For now, albums can only be private, public, or have a specified access
tokens. New albums are private by default.

Access settings are set by creating a file called .gollery.metadata in
the album folder, containing a JSON object.

The following keys are recognized:

"public": (boolean) - defines if the album is public
"secretToken": (string) - for private albums, define the secret token
                          required to view this album.

Secret tokens are passed by defining a cookie called "gollery_tokens",
containg a comma separated list of tokens (note that since the cookie
content is URL encoded, the comma is actually encoded as %2C).
ui: Add support for access tokens

Tokens are added by passing a 'tokens' query parameter when loading the
application, containing a comma separated list of access tokens to save.
The tokens will get saved in a cookie, so it's not necessary to pass
them with every page load.
Update README.md with documentation about access control