fix session cookie behaviour to be more private for not logged-in users, fixes #96

the bug was that it used a permanent cookie for not-logged in users and only switched it to
a session cookie when you logged in (and did not check the remember me checkbox).

now it uses (non-permanent) session cookies by default and switches to the permanent cookie
only if you tell so when logging in and checking that checkbox.