user has a startup() method now. do cookie autologon etc in there! moved to init() after request has inited, too, so you can read cookies etc. startup() happens right after initialize(). controller now initialize last. report any issues please. sample app changed accordingly. closes #398