Switch to sign in with email

SessionController is not checking for email when signing in since it's
uniquely generated between each test unlike the name that's always
'steven'.
Protect state_id from unauthorized users

Protect state_id from users who do not have permission to change it