Add a new remember-login attribute for remembering the login state across refreshes.

We keep the login state in the session storage and force a login in case the user was
logged in before.

This means a page refresh will try to restore the login state (which usually should mean
that it just flashes becasue of redirects). And new visitors get the logged out state by default.