moved server.defaultSecret to web.DefaultSecret. logging errors in the cookie store.
added the beginnings of a CLI to control the server