Moved logged_in_protect to be called above header-home
Use bcrypt for password security instead of sha1
Use session_regenerate_id to avoid session fixation attacks
Use remember_me email value if set else use _POST value
Added recover password/username page
Grab session user data in init.php instead of calling it on every page
form-overlay -> content-overlay