Only display last_login when defined.
Separated tokens generation from Cookie header generation
Allow passing no timestamp to audit.record_login, refactor tests.
Add login auditing as part of authentication.
Make audit just a module, no class.