Fix security bugs (missing access checks, csrf token), fix other bugs (edit records, ..), add some features (masters for slaves, ...)

- add a lot of permission checks:
  zone edits were completely unchecked (after login); only list and creation were
  protected.
- reduce regular expression usage
- don't use user provided names/ids/urls for requests; instead use them
  to search for the zone in the list of all zones.
- rename 'label' to 'name' in template records ('name' is used in all
  other places)
- make 'localhost' default $apisid
- add 'soa_edit' default
- remove gen_pw/pwgen caller; use openssl instead for random password
- fix a lot of bugs (editrecord, TXT quoting, name checking, ...)
- improve record sorting
- add CSS classes to fields
- use monospace font for field values
- min-width for record content edit field, stretch label and content
  to dialog width
- max-width for record content table cell, explicit (percent) column
  sizes
- text-align: right numbers
- display raw data in cells with $('<span>').text(...)
- add DNSSEC info and masters for slave zones
- add some RR types and disable distinction from address .arpa zone;
  show all types for every field
- rework session handling; add CSRF tokens and autologin

Sadly the code was in a very bad shape. I'm still not happy with index.php; mixing php, html and javascript like that is horrible.

The monospace font for the fields is just my own preference - if this is a problem I can undo it. Also jtables makes it very hard to style the column width - the CSS rules now are working on my screen, but don't scale well (test with long content, like TLSA records - a long hex string the browser doesn't like to break).

Also it might be nice to use more consistent names overall ('label' vs 'name', 'username' vs 'emailaddress', edit, update, list, ...).
Right, forgot to test it. Updated pull request will contain a fix.