Fixed path to web ui.
Sensible defaults for AutoMove.
HTTP auth now uses explicit tokens for API authentication.