Add auth test. Implement login failure message page. Root endpoints ("/login.jsp") will be web-only.
Update API doc to reflect 9f50df6.