disabled local admin user for preview release

it is useless until we have the ability to change the web interface config from within the browser and needlessly confuses people
use SHA2 for passwords, display correct message when unauthorized

fixes #137, #256