Cleanup of auth services to be neater and less bug-prone.
Fix the tests
Login should actually just check the boolean that gets returned now rather than look for a 403
Prune the number of email messages sent out
Add terms of use shenanigans
Almost forgot to change the transaction around the session token check back to REQUIRED