Field validation for username, email addresses

Moved field validation to model definition.
Reintroducing `SessionAuthentication` auth

`rest_framework.authentication.SessionAuthentication` is required for API frontend login