With an empty realm list the administrator could not login
move the who.ini config to the code.

The configuration from the who.ini was moved to the code.
Thus the secret key can be randomly generated on each server start.
This key is used to encrypt the authentication cookie.
Doing so ensures, that each installation has its own secret key
and the authentication cookie can not be abused accidentially.
Merge branch 'no_who_ini'