login helper takes user/pass or cookie/uh; closes #4