Converted to session-based authentication (will add SSL and OAuth2), login flow 'works', added fixtures