Minor fixes.
Use Flask-KVSession instead of client-side sessions.
Flask-Login top.user hack no longer needed.
Fix secretary auto-selection.