Login gets its own controller, because we need to specially handle the token code.
Prep for account API integration.
Merge conflict