Login gets its own controller, because we need to specially handle the token code.