Instead we simply disable the filed during the load.

We use a simple prefix notation to express complex expressions.

And cleanup permission check code.

And automatically install a .forward file.

We cannot automatically set the auth cookie any longer - the client need
to do that now.