Replace JAAS login with another mechanism

The HST JAAS based login mechanism has no knowledge of the HST, and has caused many issues over the years. And since it's being handled by the container, is completely out of our control, and usually we have to work around it. The current implementation also seems to be tied to the tomcat servlet container and would have to be modified replaced to work with any of the other containers we support.

We should replace it with something which can be integrated with the HST, for example to respect the hst:show

settings. Which generates redirects with the correct scheme (when https is offloaded). Ideally it would be stateless as well.