* Allow both xml and json authentication in sessions controller. * Raise an exception if a login attempt fails so that a) we return a proper error for json/xml requests and b) failed login attempts get reported to NewRelic (for monitoring abuse).