Refactored the verbs stuff so it's more common.

Also changed session handler to cookie session.
Got a very basic login working. Doesn't yet use the database, but it
does, correctly, check that users have been authenticated and, if not,
shows the login page.