Login expectations

• only verified accounts can log in
• successful login creates a server-managed session cookie
• refreshing the app should preserve the session until logout