b8 ready up checklist

[luceos]

• [ ] unify spa login with session based log in; best would be to use session based and for spa requests add a secure cookie or header
• [ ] connecting works, might need to verify follow up features and report in
• [ ] filtering extensions based on their update state does not work, there's some logic already to force a json response from flagrow.io of extensions that are installed (also when update required filtering is enabled) but there's no post-request handling that filters the response based on required update. Previously we would filter in JS because we had all extensions in cache/at once.
• [ ] tests don't work