updated todo list
* security bugfix, so that not approved users cannot forge their cookies
* new route for /static/css/, css on register and auth rendered
started working on fileserver
first version of fileserver completed