more thorough session destruction
add notes on HTTP 'Authorization: Basic' login
update TODO