Form login

[martyall1]

This pull requests is in response to issue #11 . Definitely open to suggestions, but I've tested it in some other sample code outside the tests and it seems to work pretty well. Let me know!

[jkarni]

This issue is a little tricky. First, there's the fact that FormLogin will consume the request body, so it won't play well with handlers that use ReqBody. Second, currently only JSON is allowed, which isn't quite what we want - form url encoded is quite likely also going to be used. Third, having application-specific authentication declared in instances isn't ideal, since often you need things like a database connection to do them, and doing that in instances isn't possible (or at least not in a pretty way).

My inclination is to make login the business of handlers that are outside of protected handlers. That said, #11 does show some issues with this. But I think if we provide a function addCookie that also provides the CSRF token, the interface will be usable enough. Then we can continue to use ReqBody for authentication credentials.

[domenkozar]

My take: servant-auth implement different sessions, while logging in with a form is an actual authentication method. Until we engineer authentication method API (and how it plays with sessions), it's not much use having it in.