Add auth protocol, implement credential checking.

I'm separating auth and app into seperate services, so that auth is public and
app is private. Users must authenticate to auth to receive a session token
which can be used to authenticate to app during the connection phase, likely
cookie-based.