strip script name from url_for generated urls

* fixes #42
* fix extra logins required -- was cause by secretkey changing
some dead code cleanup
release 2.0.2