rename include files for consistency

Some code editors treated the code as an include file instead of PHP
file, so let us just keep it PHP then.
add cookie, rename includes and allow empty db pwd
only allow legit index access