POST /create behaves weirdly when not logged in

[pkel]

POST /create has login semantics when not logged in. This produces weird errors when the client thinks it is logged in but actually is not. E.g. when the server restarts while the client is online.

Two fixes are necessary.

1. POST /create should redirect-get to /login when not logged in, ideally with a nice error message.
2. Sessions should be persisted across server reboots.

Both can be done together with #3.