nicer routes (understanding :as <NAMESPACE>), allowing either json response to login/logout or redirect
BUGFIX: only set user in session when authentication is good