added another missing module
On login, also add a Cookie since the custom authorization header only works for javascript requests.
add a route that returns the UserPasswordCtrl javascript