Refactor the login handler

The login handler is now a simpler, standalone http.Handler wrapper. The separation between the SSO application and the login handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via session cookies, but it works on a request-by-request basis instead, which makes the "back" button works as expected (allowing the user to bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single session for authentication and login state, which should remove the opportunity for session synchronization errors.

server/bindata.go

@@ -1106,7 +1106,7 @@ func staticJsU2fJs() (*asset, error) {
 
 var _templatesLogin_otpHtml = []byte(`{{template "header" .}}
 
-    <form class="form-signin" action="{{.URLPrefix}}/login" method="post">
+    <form class="form-signin" action="{{.URLPrefix}}/login/otp" method="post">
       {{.CSRFField}}
 
       <div class="row no-gutters">
@@ -1154,7 +1154,7 @@ func templatesLogin_otpHtml() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "templates/login_otp.html", size: 956, mode: os.FileMode(420), modTime: time.Unix(1561884470, 0)}
+	info := bindataFileInfo{name: "templates/login_otp.html", size: 960, mode: os.FileMode(420), modTime: time.Unix(1576445228, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -1232,7 +1232,7 @@ func templatesLogin_passwordHtml() (*asset, error) {
 
 var _templatesLogin_u2fHtml = []byte(`{{template "header" .}}
 
-    <form class="form-signin" id="u2fForm" action="{{.URLPrefix}}/login" method="post">
+    <form class="form-signin" id="u2fForm" action="{{.URLPrefix}}/login/u2f" method="post">
       {{.CSRFField}}
       <input type="hidden" id="u2fResponseField" name="u2f_response" value="">
 
@@ -1282,7 +1282,7 @@ func templatesLogin_u2fHtml() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "templates/login_u2f.html", size: 908, mode: os.FileMode(420), modTime: time.Unix(1561884470, 0)}
+	info := bindataFileInfo{name: "templates/login_u2f.html", size: 912, mode: os.FileMode(420), modTime: time.Unix(1576445233, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }