fixed session destroy
added basePath and URLPath to locals
uses basePath and URLPath to build URLs, moved login form into separate file