small logging changes
added missing tests for user's findUserByEmail
error handling changed
security config changed

- access denied handler added
- session fixation protection added