- Somewhat more consistent comment structure

Fixed a bug where users would get caught in an HTTP Auth loop on the logout page (and added a regression test).

- Renamed permission "access site" to more correct "access secured pages".  Users will need to re-enable it after upgrading
- Fixed HTTP Auth problems when caching was enabled (caused by using an uninitialized global variable) by doing a full bootstrap in securesite_init() instead of doing bootstraps separately in _securesite_filter_check() and _securesite_user_auth()
- Rewrote and separated a bunch of tests to make cache problems more evident
- Added some cache tests

Move password reset handling to separate function (to ease testing later)
Don't show site name on login form (improved consistency)
Fixed erroneous variable fallback on password reset form
Further improved securesite_user() so Secure Site is really only triggered when it should be