Prevent login hijacking, simplify remote auth.

API Login hijacking protection by adding a first-party caveat with the
username in the reauth macaroon, checking it on reauth Login attempt.

Refactor API remote login tests to reuse reauth credential
acquisition, add login hijacking attempt test case.

Simplify the remote EntityAuthenticator by removing the Juju login
request nonce -- this nonce is really only relevant for local login.