Got login working. Authenticate needs to be implemented in the session and enforced.