Authenticate with email and password

Verifies credentials and returns a 24-hour session token. Revokes any existing session for the user.