define what a package url is in a function
make a destructor for curl_slist

Fixes a potential leak and out-of-order checking in the AURSID update
logic.
Avoid appending extra Expect header

Apparently this isn't needed...
add aur_logout and frontend wiring
do away with synthetic login errors, validate cookies better