Security: Fixed http auth login.

Did not detect login the first time we got http auth header.
Also was creating new session every time we got http auth header, which is on every request.

Signed-off-by: matematik7 <domen.ipavec@z-v.si>
Config: Added global configuration options and implemented them.

In global configuration:
 session cookie expires setting
 default allow option for modules
 default allowed users option for modules

Signed-off-by: matematik7 <domen.ipavec@z-v.si>