Changes after /login code path review

1) More debug statements.

2) Tweak some log messages.

3) More comments.

4) Don't set Content-Type when there is no body.

5) Make sure we handle all errors.

6) Do not catch all inside the router: better to crash the
   server in case there are programming errors, so we notice
   about such errors more quickly.
Better internalError() log message
Add AUDIT file

Add the "/login" code path with audit level two, because I've
done my best to audit such code path.
Merge branch 'audit-20140409'