User login and session creation.  No user authentication or authorization. Added password to user.