login page
turn off authentication on main page for now
add xsrf thingie on config form