simple login/logout using configurable tokens, upload capability "may_upload"

note: flask uses werkzeug's signed secure cookie, thus having may_upload in the cookie is safe.