Auth / session mocked — TODO wire real login

MVP skeleton