Add POST and DELETE endpoints for device management
This MR adds the following:
- Interactive auth flow for
m.login.password
- The DELETE and POST endpoints for device management
- Fixes a small security hole with the PUT and GET endpoints that would have allowed a user to change the display name for someone else's device or get details about it