When logging in, also send back token info in the response body.

This is to help support clients that might not want to deal
with reading and passing cookies around. Soon, I will add the
ability to authenticate to an endpoint using params instead
of just the cookie.