Note to developer: Replace this form with real authentication. The app uses a userId in state (currently 'paul'). On successful login, call loginAs(userId) with the authenticated user's ID. Users live in db.users[] seeded from USERS_SEED.