Create a new JWT for authentication and set a cookie if using HTTP.

SessionCreateRequest is for logging in.

SessionResponse wraps the created token or returns an empty string if deleted.