We use a simple prefix notation to express complex expressions.

And cleanup permission check code.

And automatically install a .forward file.

We cannot automatically set the auth cookie any longer - the client need
to do that now.

That way we can reduce the number of gettext() messages.