Added support for authentication methods.

This commit introduces `/api/v1/auth/login` and `/api/v1/auth/logout`. These methods make use of the internal storage system to fake a session. Note that the `nav` object will be populated by a separate API method as @jmeas and I previously discussed.
not `delete`, deferred to gc by `null`ing.