Using cookie-based sessions for web-frontend authentication

closes #323