Auth Filter

see https://gist.github.com/jnorthrup/84c5e03c8f6dfb1258c3

for gwt, this requires 2 seperate gwt entrypoints and/or modules, one rename-to=app and one rename-to=auth if done by gwt.xml

so rpc should always be /app/something, and all authenticated features and data likewise.

if the user is first hitting / then /app takes the user right to the app where a 303 will redirect if they are un-cookied with a valid session.