Implement create, startLogin, and finishLogin sans SRP

r? @dannycoates