o restructure session open/close for better visibility
o remove potentially insecure "try again" button
o remove override for switching csrf off (defer)

(dashboard, widget) spacing and small layout changes in ntp_status.widget.php, very anchient and unreadable code.... not spending more time on this now

use data-plugin to define the data collector (server side api/plugins/ plugin) and data-callback to define the javascript function to call after receiving data.
The callback uses 2 parameters (sender, remote data), where sender is the dom attribute on which the data-plugin was defined

(dashboard) the weirdness around stats.inc, getstats.php and ajax.js needs to be replaced with a more structural solution.

Because all current widgets depend on legacy code and we don't want to pollute new style mvc code with it, we choose to build a new broker in the old structure.
This commit only includes the basic setup for the broken and an empty gateway_api() function