Use JSON to respond to logins instead of headers

Also makes the user group accessible