[webui] Extract authentication actions from UserController

It did not make sense to manage login/logout actions from
`UserControllers`, reason why they were moved to its own controller.

Note that this change also implies modifications in routes

  - GET  user_login_path    -> GET    session_new_path
  - POST user_do_login_path -> POST   session_create_path
  - POST user_logout_path   -> DELETE session_destroy_path