Rework session handling; add CSRF tokens and autologin