Fixes to create_session endpoint per changes to the SMIMP spec. Endpoint now /create_session/<username> for both GET and POST requests. Second request body is just signed base64 encoded login token. Validate session logic for extending sessions was incorrect. Fixed.