Added favicon
Removed dynamically generated secret

It doesn't play well with GAE: it gets regenerated at each respawn.
The best solution is to put it into the config file.
Fixed security issue + expire when API changes.

- I had forgot to hash the secret in the MAC :)
- The mac now contains the API version, so old API cookies expire
  automatically.
Moved level reached by users in the datastore.
Bumped API version to v2-3