The login wasn't able to modify the session as it was already closed
earlier.

This patch also executes the correct event when logins via XMLRPC are
done.

If the user is already logged in, a 403 is sent instead now.

This is far from perfect but should solve most issues in the recommended
configuration where only authorized users have access. Sending proper
status codes should be implemented when the API implementation
refactoring is done.

This reverts commit ba6c070e.
This reverts commit 92351008.

jquerized

  * Fix selector in subtree loading callback
  * Remove HTML inconsistencies between AJAX and plain PHP lists
  * Unify icon and CSS class switching in dw_tree and dw_mediamanager

Make it faster, prettier, less wrong, add UI effects, use jQuery UI Dialog,
Abstract tree view stuff away into jQuery.dw_tree

There are probably more functions that should go in here

  * Increase HTTP cache time since the resources are timestamped on request
    anyway
  * Check userscript.js only once for JS cache validation
  * Use cache class