move openAtLogin to prefs, prune dead code
handle keychain errors better