Instead of handling the visibility checks at render time we keep around a list
of visible routes and emit an event when they change. This way the welcome activity
can mirror what the menu shows and update at the same time.

Setting auth/token in <dbp-components> directly without <dbp-provider>

See issue #49

Dispatch dbp-set-property event to parent (if any) so that current element doesn't terminate event if it has the attribute set itself (#48)

This field specifies a list of roles that the logged-in user needs to
have to interact with this activity.

In the case of the app-shell this means the activity is hidden until
the user information is loaded after login.