Add /v1/session POST (user authentication)