Rename /api folder to /service.

Also add sesssion_destroy logic to api/auth/index.php.
Very simple Mozilla Persona standalone login page.

I included a very simple example in login-test.php of checking the session for a logged in user and redirecting to the login page if not present.  Something like this type of logic would need to happen in the main page of the site.

In order to logout a user, you would just need to make a POST request against service/auth/index.php without any assertion data.  This will destroy the session.