Allow local authentication with LOCAL_AUTHENTICATION=1

You can touch `tmp/local-auth.txt` to persist this setting.

app/controllers/sessions_controller.rb

@@ -1,6 +1,27 @@
 class SessionsController < ApplicationController
+  before_action :require_local_auth, only: %i[ new create ]
+  require_unauthenticated_access only: %i[ new create ]
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." }
+
+  def new
+  end
+
+  def create
+    if user = User.active.authenticate_by(params.permit(:email_address, :password))
+      start_new_session_for user
+      redirect_to after_authentication_url
+    else
+      redirect_to new_session_path, alert: "Try another email address or password."
+    end
+  end
+
   def destroy
     terminate_session
-    redirect_to Launchpad.login_url, allow_other_host: true
+    redirect_to_login_url
   end
+
+  private
+    def require_local_auth
+      head :forbidden unless Rails.application.config.x.local_authentication
+    end
 end