added a 403 (forbidden) page & header
multiple minor fixes & improvement
FIX session id not put in long-term cookie
modified router to handle routes from an XML instead of a JSON (may be more verbose, but definitly shorter and slightly more readable)
FIX define current user on class level of auth controller
FIX optional parameters not working (errors in use of DOMNodeList methods)
router: focus on 'route' nodes and ignore whitespaces
validate the route definitions via a DTD
switched to v0.4
moved route definitions to the app folder, updated README.md for v0.4