Adds session controller to server side
Add some tests for the LoginCtrl

Stubbing out the authentication service was not as obvious as expected.
First had to use sinon to stub out the service's login method and return
a promise.  When using Angular's own $q promises, to resolve the promise
need to call `$rootScope.apply()` as well as `resolve()` on the deferred
object itself.

Its all a bit over-engineered for what it really is but maybe its a
useful exercise in isolating components.