Better 'please log in' text
Broadcast login and logout events, and update view appropriately
Fix cookie parsing bug

Previous parser stripped '=' character from values
Tidy up
Change API

Previously, "/api/" was ambiguous. Requesting the list named "" would
lead to this endpoint, but it was also used for getting the names of all
lists.
Move hostname out into config file