login: add username and password escaping; idea 'asAdmin' in Session and
not in cookies