ControlRoomMiddleware is a new-style middleware, but that makes it
somewhat hard to unit test.  So we just split up the request and
response processing into separate functions which are called
within the __call__ function.

Complete rework of authentication middleware and backends for
both the web view and the API. There is now a single URL (after
the login page) where the shibboleth attributes are put into
the session and the user is authenticated and a persistent
Django session is created.