log error messages in web paths

HTTP requests were only returning the error message to the caller, not
logging locally. In most cases the problem could be understood
client-side, but there are some exceptions. E.g. if Moonfire returns
a 403 on WebSocket update, even in the Chrome debug tools's network
tab the HTTP response body seems to be unavailable. And in general,
it's nice to have more context server-side.

Logging a `response::Body` isn't practical (it could be a stream), so
convert all the web stuff to use `base::Error` err returns.

Convert the `METHOD_NOT_ALLOWED` paths to return `Ok` for now. This is a
bit lame but punts on having some way of plumbing an explicit/overridden
status code in `base::Error`, as no gRPC error kind cleanly maps to
that.

Also convert `db::auth`, rather than making up an error kind in the web
layer.

This is also a small step toward getting rid of `failure::Error`.

server/src/cmds/login.rs

@@ -17,7 +17,7 @@ fn parse_perms(perms: String) -> Result<crate::json::Permissions, serde_json::Er
     serde_json::from_str(&perms)
 }
 
-fn parse_flags(flags: String) -> Result<Vec<SessionFlag>, Error> {
+fn parse_flags(flags: String) -> Result<Vec<SessionFlag>, base::Error> {
     flags
         .split(',')
         .map(|f| SessionFlag::from_str(f.trim()))