Respond to login attempt for unknown user as 401

Instead of 404 so as not to give hints
Add login controller tests
Correctly set user email into JWT token value
Add token verification endpoint

Closes #9