enable authentication to protect add and delete

use flask-login extention to manage the drudgery of session management.
Nothing fancy yet; passwords are stored in plain text and I haven't done
anything with the token to make it more secure.