Login now handles the 3 login states: no_agreement, enabled and disabled. Writes "state" to the request session. If state is disabled, prints an error when trying to log in. If state is no_agreement, displays the TOS page, which is a JavaScript-enabled page allowing the user to accept the agreement.
html.py: This required changes to HTML to display the header correctly (display the user logged in but not the app tabs).