Admin login fixer upper

Adds new route that allows admins to login. 
Fix up user session/admin session validation 
I mean, it makes sense to post it all to `sessions.store` and have the app figure out what to do from there. It might be kinda strange to have it posting to a bunch of different routes, since it's still a 'session' we want to create.  
We can have a hidden form item on the admin form and check for that instead of the referer, but it seems more hackable that way.