Authenticates against the server. Password isn't verified yet — any details sign you in and issue a real session token.