Login loop in code editor when no $.user object for given ID

A weird edge case which causes an unexpected login loop. To reproduce:

* Start a fresh database from the current core (as of 9a58103).
* [Open a code editor for `$.thing.name`](http://localhost:8080/code/?$.thing.name) or any other unimportant property.
* Use your browser URL bar padlock menu to delete the `ID` cookie, if present.
* Make a trivial change to the property being edited (e.g. "The thing prototype").
* Click "Save".
* Note that a login window opens. Click "Sign In".
* Note that the code editor now has a butter bar saying "User not logged in", and the login window has reopened.

The cause is that, although the login server has successfully set the `ID` cookie, there is no `$.user` object corresponding to this ID in `$.userDatabase.byMd5`, because at the moment _user objects are only created by the telnet server_.

This has the effect of making it impossible to have code-only Code City instances. Proposed fix:

* [ ] Extract login and associated `$.user`-creation code to a general-purpose login function shared by both the telnet and http servers.
* [ ] Ensure that any save which results in the ownership of an object (e.g., because it creates a `Function` object) is enough to prevent the owning `$.user` object from being `.destroy`ed. We don't want a user who's never "created a character" being assigned a band-new $.user object for every save!