use crypt_password as cookie value, not created_at
add login protection.