Pass headers and status on token errors
Simplify the token request

Rename the SessionGrant to the SessionAuthenticationGrant, explictly
tying it to the Pyramid SessionAuthenticationPolicy, where the default
token credentials can be set implicitly. The token route becomes very
dumb.
Simplify the Pyramid events

Drop the LoginEvent and LogoutEvent. As far as the main application
is concerned, this stuff is all subsystem specific. The is a breaking
change because the list of personas the client used to rely upon in
the session is now gone. Along with this, drop support for clients
running cold older than v0.2.
WIP on single sign on