feat: authenticate via HTTP header, move auth operations to REST API

### Additions

* `/auth/login` endpoint for login
* `/auth/logout` endpoint for logout
* `/auth/session` endpoint for checking the validity of your current session

### Deletions

* graphQL mutation `login`
* graphQL mutation `logout`

Closes #316