Add login API.

It seems to set the session cookie appropriately.
More work on login/logout. Change username to email.

The API is a bit ad-hoc. It would be nice to research some best
practices from other APIs, eg. Parse, etc.