login page and protected routes

[ojn03]

• Migrate to code grant flow rather than implicit token grant, which exposes access token to client. Essentially this means that rather than adding the access token directly to the url header, it adds a one time code which the server can then use to request the tokens from Cognito
• Enabled route protection, so users can only view certain pages once they are logged in.
  For this to work, it is necessary to add the following env variables
  NX_CLIENT_URL
  NX_COGNITO_CLIENT_NAME

Future plans are to store tokens within cookies. Currently, because they are stored in memory as a variable, users are logged out on refresh.

[circlegov]

LGTM! sorry for such a late review