end-to-end login

da full flow

![image](https://cloud.githubusercontent.com/assets/339996/3206733/965db570-edcc-11e3-92e9-8f4872af5e1b.png)

I'm cool with it if we always call the session key a session key, but we just gotta be clear about it