I think I have to move login from REST to its own script, which is unfortunate but I see no other way of doing it
Got login forwarding and preliminary sessions working so yay me