Reduce lock trace verbosity for now
Fix HTTP server secret, generate session IDs and cookies (issue #767)
1st pass at built-in passphrase handling (does not work)