fix issues with io-core intercommunication

log in at start up, save useful data temporarily in
request.registry.session, send auth flag nicely to js