fix 2833009ec5c51efa1e35c0718ec8f901710db5e5 (backdata.Connection)

lost line in `extjs_load.js`
+ App.cfg = app.config ,App.user = app.user ,App.role = app.role
(dump commit, refactoring, this bug...)
extjs_launch(): enable `state.CookieProvider`

* `node-webkit` 0.9.2 is OK
* `state.localStorage` is for local JSDuck
userman: move `can` list in `req.session`

thus one user can login multiple times
but if one session (browser), then one possible login per user

*fix bug*: access after free
-            req.session.user = null
-            req.session.user.can = null
bug security `userman`: don't allow session.destroy() in 'logout' if fail