enable api_user, dynamic password on each startup, https certificate, cookies from client side
Merge branch 'newbranch'