cleanup rwm overlay; init/destroy session cookie; strip (optional) leading 'rwm-' from config directives

PP_accountLocked error for locked accounts. (Gives too much information
to attackers.)