Login

Session-based auth (cookies). Minimal MVP.