fix(controller): properly serialize JSONField objects

JSONField is a finnicky thing. When serializing the object in the API,
it will just dump the object as a string. This ends in an invalid JSON
response. In the case of the Config object:

    {"owner": "bacongobbler", "app": "go", "values": "{\"HELLO\": \"world\"}", "memory": "{}", "cpu": "{}", "tags": "{}", ...}

This fix changes the JSON output to the following:

    {"owner": "bacongobbler", "app": "go", "values": {"HELLO": "world"}, "memory": {}, "cpu": {}, "tags": {}}

This is completely backwards compatible with previous requests. The
JSONSerializer will accept both strings and JSON objects in the request.
fix(controller): retrieve logs via GET request
fix(builder): properly parse config vars

Previously, the entire export from `jq` was considered one string, so
when we printed the output it would be like "-e HELLO=foo GOODBYE=bar".
This fixes it to "-e HELLO=foo -e GOODBYE=bar".

I also removed the for loop in favour of a list as bash invokes a
subshell in for loops, losing any data you set (such as BUILD_OPTS).
style(builder): fix typo
fix(controller): set default config owner to request.user
fix(controller): inject config on top of existing environment
fix(controller): do not commit to latest

while this was a nice-to-have before, we are actually pushing config
values on top of the latest build, which breaks config:unset.
fix(controller): use build tag if present
Merge pull request #2116 from bacongobbler/apiv1

API v1 fixes
Merge pull request #2127 from bacongobbler/2100_env_in_dockerfile

fix(controller): inject config on top of existing environment
ref(controller): disable CSRF token authn/authz
ref(controller): switch to token-based authn

When pulling out CSRF tokens from the authentication requirements, we
are still relying on cookies. This is great from a CSRF attacker's
standpoint as attackers can easily `<iframe>` the site that utilizes the
API, generate a POST request and re-use the existing cookie. Using
token-based authn fixes this because there will be no existing authn
cookie in the request. With this change, we are also not vulnerable to
XSRF attacks either because we do not store a validated login cookie
in the browser (yay!).
fix(controller): remove PR cruft
style(client): expand string
fix(client): remove call to /api/auth/logout
test(controller): make tests use authtoken
test(controller): remove calls to client.login

Django's default test client relies on session handling and cookies for
authorization, whereas we rely on token authorization. Essentially, this
tests nothing as it's an unused workflow.
test(integration): remove cookie test

With token-based authentication, we're no longer storing sessions in a
cookie.