fixes #3930 - refactoring of edit_self implementation.
fixes #3280 - authenticate returns true for API requests when login:false
fixes #3312 - support /users/extlogin as a login page based on REMOTE_USER
fixes #2988 - merge authentication code, enables REMOTE_USER auth on new API controllers