implement authentication

[pirj]

make a simple controller extension that by default requires the user to be authenticated. for a login/logout controller, provide an example implementation (with initialize method override that doesn't force the session to contain an user to be set)