We used to just ignore the key.
Also separated the code for handling key updates from other
user updates. This should eventually be moved to a different
route. Mixing the two makes the implementation really hard.

fixes #8796

Cleaned up UserController#update earlier but missed that it was
used to change fallback email addresses. Now it is back. This
time including an integration test.

feat: allow unauthenticated access to list of configs

Closes #8800

See merge request leap/webapp!45

fixes #8801

Includes a test reproducing 500 on lynx

We now make use of ActionController::Parameters require and permit
methods.

They used to be sorted by the code which was not helpful

fixes #8806
requires deploy of new design docs to the platform

On a failed login the warden failure app gets called.
Some of the params are changed accordingly but controller
and action remain.
set_locale would detect there was no locale in the path
and thus attempt to redirect. However the params still
belong to the previous request which was a POST to
  Api::SessionsController.
This route does not respond to get requests and so it
would trigger a 404 in production and a 500 in development.

This commit prevents set_locale to act upon warden failure
app controller calls by adding /new to the list of
`NON_LOCALE_PATHS`. (The path is updated by warden to the
name of the action called in the failure app).

A test is included in this commit that tries to login
with an invalid username, password combination and a german
locale set.

fixes #8805

This should simplify client code significantly according to
platform#8849

We now use the hash of the token for comparison and as the id.
In order to use it you need the original token though. So forms and
thus the session should have token.to_s rather than token.id.

our special error handler for json requests would turn all exceptions
into 500s - removed it. now the rescue_responses can do their thing
again.