login now stores autologon cookies without cleartext password, improved the sample app user a bit to make it a better example, added RbacUser::grantRoles. closes #354 and closes #355