login placeholder

POST /api/auth/start  {email}
POST /api/auth/verify {email, code}
Cookie is set on verify.