added tests for details controllers
added admin login test
reduced packaging contents
switched auth check for password change

now uses CSRF-susceptible cookie 'token' instead of secure Authorization header. Fixes #26