portal for nonpublic data

the mr !24 has become to complex. part of the complexity is that each object may be viewed with or without login, which also requires lots of error handling for session timeouts, etc. we start over again and assume, that there is always a sessionid wanted, a login required and nonpublic objects shall be viewed. this will be a config flag, for portals operating on "nonpublic" data, similar to the sandbox portal