implement login for fake auth

@rfk r?