Work on gh-5

Cookie secret comes from a file, there is now a 'userdb'
where we look for bcrypt password hashes, and an 'adduser'
command line argument to add things to the userdb