Web: do not use state codes directly

State codes should be accessed througth the JSAProcState class.
Added a pre_run entry to the state information table so that we
can construct the list of pre- and post-run states.
Web: read secret key from config file
Web: use redirects on login and logout
OMP: cache the crypted staff password