Moved the log message to server.go
Added cookie (session) authentication. Login/logout to follow shortly.