Let users create rooms with passwords, and log into and out of them

Notes:
- There aren't usernames -- only handles for a particular room
- RoomSessionsController uses signed cookies to remember which rooms you've logged into
- Tracking handles and their uniqueness will be handled in a later branch

any reason to not use form_for?