moved admin pwd to config

also made an example-config
ignore config
Check for pwd cookie on all admin pages