This adds unit tests for our authentication flows (our HTTP auth handlers
andvsession authentication). These flows have recently been updated to
include web-based login, so it's a good time to add unit tests for
these.

There's a TODO note left in here to flesh out the OTP login flow, since
this is too outside of the scope of my web-login changes.

Ran unit tests.