Use web.template.render to render index.html and login.html, so that
/index.html and /login.html can't be viewed directly.

Previously index.html and login.html are served as static files via lighttpd,
which fails to protect them from being viewed by unauthorized users. This patch
hides these two files from users, rendering them through web.py's template
interface.

Signed-off-by: Min Chen <minchnew@gmail.com>