Web login

Use a human user from users.yaml. Scope access still comes from scopes.yaml after login.