add user during seed (pw is hashed, but should still be changed); add authorization requirement to user routes