Added support for authentication methods.

This commit introduces `/api/v1/auth/login` and `/api/v1/auth/logout`. These methods make use of the internal storage system to fake a session. Note that the `nav` object will be populated by a separate API method as @jmeas and I previously discussed.
Maybe this should be `null` when there's no user.