CollectionFlex auth

Register, sign in, sign out, and call the signed-in endpoints. Served by the auth service itself, so the session cookie is first-party.