Change session interceptor to a transform

The difference is that, while both get to intercept and handle the
response, only the transform can change the result that updates the
resource instance.

In this way, it's not necessary to copy the response data onto the
scope anymore because the object is updated properly in place rather
than being updated with the wrapped response containing the csrf
token and flash messages and other parasession data.
Break auth from app and add tests

Does what it says on the tin.
Break out callbacks in auth controller
Merge pull request #1346 from hypothesis/break-auth-from-app

Break out auth into its own file and add tests.