login_required decorator in Flask
I would suggest using:

if 'auth_token' not in session:
    ...


Since your login function suggests that auth_token is not a key in session, unless the user has logged in.

Other that that, I can see no other improvements.