JSON routes do not need it but added for consistency

Those tokens are only created by the login route so
those should not allow users to authenticate if the login route is disabled

The login route is now disabled by default.
It was previously enabled by default.
It is why it is a breaking change.

Closes #702.

Otherwise exceptions raised on commit are not caught by the api exception view deriver.

refactor(exceptions): define custom api exception, a view deriver to raise them and view exception to display them

Fixes #32 and cubicweb/cubicweb#680

Closes #30.

Which is more pythonic.

Reverts to the base pyramid_jwt implementation but with a custom serializer which simply returns the given value. Needed as the JWT token is already base64 encoded.
This fixes authentication issues using the cubicweb_web login forms.

Errors are logged using the info level