Rewrite auth

The rewrite should include:

• Backend auth refactored to confirm with the OAuth 2.0 spec
• Frontend should use cookies instead of localstorage
• JWT lifetime cut down to 30 days instead of 2 years
• JWT-s scoped to different access