turn no eagar mode by default

- easier for development, however, it's not acceptable for production.
several refinements

- push more user-info to client-side
- temporary implementation of post-2-login