architecture change for database API

* leverage the web.database module
catch DB initialization failure
implement login module
implement secret key for secure cookie
validate cookie

* don't use session ID for now
add logon template