Use cookie for credentials instead query param

Add a login cookie which experies after an hour containg the login
information.
The logout deletes the cookie.

Also use an exception based system to indicate whether a login was valid
or a user accessed a page who hasn't the level for. This is wrapped in the
NewAuthHandler, which will replace the current AuthHandler.