Request trait: authentication, CSRF and session bugs; missing features #103

Review findings for the Request trait, split into one issue per topic. The details, file:line references and verification status are in the sub-issues.

Milestone 7.x (no breaking changes)

• Request: findUser() login crashes and session values get lost #129
• Request: built-in login and a working CSRF helper #131
• Request: client setup hook and request builder helpers #132
• Request: file uploads #133
• Request: update README #136

Milestone 8.0 (breaking changes)

• Request: apply authentication per request and fail on missing overrides #130
• Request: query and JSON encoding #134
• Request: make DataBuilder immutable #135

Removal of deprecated APIs and UPGRADE-8.0.md: #137