1. extend Security.login to serve both FORM and Ajax
2. reserve Security.setLogin only for auto signin
3. remove Security.setLogout since useless