Add handler for /api/auth/login and global structure to expand from
there.

Also add a /foo handler to test authentication.