Expose login_manager
Support remember me
Use bytes SECRET_KEY
Use HttpOnly cookie for "remember me"
Ignore remember_token_expires_at column