It doesn't do much yet, I'm just sketching out the basic elements and starting to get a basis for something that will work
I would have done a DELETE to /login/ to make it like a resource but my browser won't do a raw <form> with method="DELETE" :(
This doesn't do much - it'll authenticate any username and password. But at least it will show me when a user is logged in and when they aren't, which is useful to start figuring out the workflow for sessions