[Closes #39, Closes #48] API client can authenticate a user by email/password, test db fixtures helper added

[francisli]

No description provided.

[francisli]

@michaelyshih

Implementing CSRF tokens involves adding an additional request to get a token before submitting.

But I'm still not convinced we actually need them to mitigate CSRF attacks. If we use the SameSite=strict setting on our cookies cookie, then browsers will not send the cookie when a request is initiated on a different (i.e. attacker's) site.

Also, since our API is a JSON-based API, they can only be invoked from XMLHttpRequests (i.e. not form submissions), which are also subject to CORS settings, which also restrict the ability for attackers to call the API from different (i.e. attacker) sites.

So I think we can reduce the complexity of our API by removing the CRSF related code...