basic application-level login and logout

For issue #79.

To get started, init a project in the usual way. In `deploy/build.properties` or your environment properties, set `default-user=${app-name}-user` and `authentication-method=application-level`. In `deploy/ml-config.xqy` uncomment the role XML for `ml.app-logged-in-role` and the privilege XML for `roxy-logged-in`. Edit `$ROXY-ROUTES` in `src/app/config/config.xqy` to add `protect` elements for any pages you want to protect. Finally, bootstrap and deploy modules.

You can also manage `ml.app-logged-in-role` users through the new `ml` actions `list_users`, `create_user`, and `delete_user`.