Login returns a *http.Client populated with the `user` cookie set upon successful login.

Token returns a *http.Client with a manually-set `user` cookie.