implemented login screen
disabled auto-login
switched last username to localstorage instead of cookies (server doesn't need to know it after all)
refactored password management and key creation/encryption/storage