Add login API

There is a possible issue here where both api and html routes share the
same controller, because the reverse routes can only map to one.
Whether this is a problem depends on where the JS reverse routes come
from.  If these need to be correct (or we want to eliminate the
warning), we should use a common class.

Play's routing package structure is still annoying.