minor auth display changes
allow custom requesthandler overrides
auth firstrun fixes.

use sha1 password hashing by default - it is expected in the login sequence.

check whether the auth:id in the session has a non-empty value, rather than
just check for the existence of the key.

print (no user) if there's no user, for clarification (rather than assuming
some field is blank).
db.php: fix verifying row id's

check for the existence of rows first; xpath may not return
results, for instance for the custom db/auth.xml during firstrun.
don't start session twice; add psp_xml_include

check if the session is started and if so don't start it again; custom
request handlers may want to read the session and thus initialize it.

add an XSLT function to include XML directly;
using <xi:include href="$x"/> where $x is resolved using xml_uri doesn't
work properly due to special treatment of XSLT files (merging an xinclude
resolution during parsing).
rename global $db to $xmldb

and remove any global $db declarations in functions
that do not actually use it.