exclude some parts of user-session-related state from SSR rendering

closes #2614

the gist: during SSR we used to try & load some basic user details from
the db to partially hydrate state. by removing this step, server load
will go down a bit, and we can avoid some dangerous situations by
limiting user related queries to API requests only.

stop doing a "probably logged in" in-between state in the header -- this
fixes a disorienting in-between state in the header.

we only use koa-flash during account creation, so we can scrap it now
that we have a new faucet.

the only bits of session-related state we're using are:

* csrf token
* login challenge token
* user prefs (nightmode, locale)
* new_visit (used for the welcome banner)

also remove some tarantool danglers

finally, remove unused ref to signup bonus