add support for manifest injection with rampup during login

this is a first version of manifest injection into the response to the
login request used with rampup parameter.

It's basically a copy of middleware/manifests, so there should be some
refactoring to be more DRY.