cleanup cookie defaults
cleanup logic
fix Authoritative handling
For the auth POST, we know who the user is, so log it
make indent
Test suite now actually performs a complete login flow, with assertion
verification and tamper detection.