adding warning message for "don't forget auth handler"
Implemented client-side authentication (login/logout).
However, passing the credentials to the REST service calls is not
implented yet (dunno yet how to do this)
removed obsolete thing
implemented cookie-based session authentication
- including login, logout
- still missing: CSRF protection