login now has default params; homepage can login/out; use slim encrypted cookie