This allows signup, profile edits and login/logout.
Note that due to poor naming, there are conflicts between our session
model und what devise thinks a session should be. In particular, we have
to rename `new_session_path(resource_name)` -> `new_user_session_path`
and `session_path(resource_name)` -> `user_session_path`.

Cf. https://github.com/heartcombo/devise/issues/2800

The state is now fully client-side and handled in session_controller.
This allows us to continue to broadcast the session frame to everyone.