I would have done a DELETE to /login/ to make it like a resource but my browser won't do a raw <form> with method="DELETE" :(
This doesn't do much - it'll authenticate any username and password. But at least it will show me when a user is logged in and when they aren't, which is useful to start figuring out the workflow for sessions