Friendlier error messages from logins
Logins now write IP addresses to `sessions` table.
TODO: Move the session write to the auth-context apply or closeContext() method
so last IP is consistently updated?