login form
redirect with JWT token in query string
user clicks log in
creates session
redirect