[PATCH 0 of 6 v2] LoginRequired simplification

[Thomas De Schampheleire]

This is a reworked version of a series I sent earlier.

The controversial patch adding 401 Unauthorized usage for invalid API keys
has been removed.

The categorization of flash messages has been changed based on feedback
from Mads.

A remaining question is the difference between
    raise HTTPForbidden
and
    abort(403)

Both are used in LoginRequired now...