patch login security hole, trim readme

never tell a user whether pw or username is wrong, only both
moved readme todo list to issues