more thorough session destruction
add notes on HTTP 'Authorization: Basic' login
update TODO
Merge pull request #25 from pmjones/develop-2

Thorough session destruction, update README/TODO