Last commit before Server code freeze; LoginAction now sends a LocalUser object instead of just a username and rights object.