test post and comment controllers

Adds AuthenticatesUsers feature trait that runs the full
signup -> confirm -> login flow and exposes the resulting auth
cookie. Bumps phpunit defaultTimeLimit to 30 seconds so the
multi-bcrypt-per-test feature flow finishes inside the limit.

backend/phpunit.xml

@@ -4,6 +4,7 @@
          bootstrap="vendor/autoload.php"
          colors="true"
          enforceTimeLimit="true"
+         defaultTimeLimit="30"
 >
     <testsuites>
         <testsuite name="Unit">