Basic, extremely naive authentication API.

This duplicates, but not quite, much of `cas_provider.views.login`. Only email/password combinations are supported. No socialauth, no complicated authentication workflows. No, not even merges. Basically, if there are any problems, an API client should direct the customer to the web interface.

As I mentioned in the channel, we probably want to implement some options on the account profile page to add an email and password to the account.