rework authentication
added CSRF token to all forms; minor authentication fixes
make ApplicationController#current_user a helper_method in order to stick it in the layout