XSRF protection. Login uses <form>.

- Using tornado authentication framework described here: http://www.tornadoweb.org/en/stable/overview.html#id1.

- Include an xsrf token to all requests which client must send back in all POST requests to protect against xsrf attacks.

- regex for validating username fixed

- I found on Chrome, `window.history.back();window.location.reload();` would leave on modal window overlay after login/logout, and also would cause you to go back to third-party site if you came to login page directly from one. Solution was to use absolute redirects. For login, uses the 'next' parameter which the tornado auth framework automatically fills with the url trying to be accessed.

- Login uses form element so you can use the enter key to submit and so browsers suggest to remember password.