implemented login on /account/create

This adds `sessionToken` and optionally `keyFetchToken` to the response from `/account/create`. No need to immediately call `/account/login` anymore.

There's a refactor opportunity to combine the common stuff with login, but first things first :)

r? @rfk @chilts

cc @ncalexan