update server code

add Auth object.
add login handler.
add logout handler.
add xsrf protection.