Add signup endpoint, enhance test-auth, make sessions actually save
'_user'