Many different ways to do this,
would recommend using at least google oauth2 and something using a db on heroku.
Unless someone has a different idea.
For the moment, just being able to log in and out and demonstrate this by dumping session info in a webpage is good enough - Eventually issues will be created to move web pages behind authentication.