login: show an authentication dialog as needed (fixes #25)

The dialog is shown as a popup window. The state of the applicaiton
doesn't matter -- we simply show the dialog when we notice that we
need authentication. So in typical usage the user will see the dialog
when first accessing the app. If the session cookie or auth token
expires, the dialog will automatically reappear.
auth: add some documentation