Make the current_user parameter persistent

This makes sure that if you pass ?current_user=username your current
login is saved into the session, so it is also valid on subsequent
requests without the current_user parameter.

Logging out can be done by adding ?current_user=
Dynamically generate a secret token if none exists

Closes #24