some minor improvements

* added tests for login
* added hint to READEME.md to set `application.secret`
* link to a statements discussion threw 'Action not found' error