added login form

Login form pulls username and password from application config (not
database) and authenticates. Successful login sets a session variable
(logged in).
logout added

Gotta be able to de-authenticate
add login_required decorator and redirection

Add a "login_required" decorator to force users to be logged in to
access certain functionality.

Add a base class for the login form called "redirecting form" that
will redirect you back to the page you were interested in before getting
forced to the login page.