Application-Layer Login

saves credentials to session or permanent cookie