Move do_log{in,out} out of AUTH_SERVICES

Rationale: we don't want templates to be able to call them.
Restrict templates to read-only things
Add per-election AUTH_SERVICES

For now, they are not referenced anywhere, but seem to work when
accessing directly their URL.
Rework login/logout log messages
Simplification
Use per-election authentication

 - base template is abstracted over login_box
 - per-election templates and services (except those related to
   update_credentials) refer to per-election auth services
 - login templates are parametrized over AUTH_SERVICES
Add a visual indication of what kind of login_box is shown
Invoke CAS with renew=true
More precise acl type and anonymous eligibility message
Move auth_config to metadata
Add auth_config to demo election
Put delimiters around list of auth systems
List authentication systems in body of Login.choose