Fix login/signup: use db.session.get(), fix CSRF ordering, fix password validation, handle non-JSON errors