add Flask-Login
fix staff permissions
add login & logout
add navbar widget