Fix #5, #6, add login, CSRF guards, client-side timestamps.