Move some login concerns to AuthController.

Some test cleanups as well.