@lefnire => API Auth working + 1 test

So, first off, I should say: I think we should take a serious audit at the security implications here. I'm by no means an expert and this implementation is definitely not rock solid by any means. So, that being said, don't merge this into develop yet. I don't want anyone's data being released on beta.habit. Pull this into a separate branch of your own so you can test it alongside habitrpg-mobile.

The implementation is fairly straightforward, plus I included a test.

```
curl --compressed -X POST -H "Content-Type:application/json" \
  -d '{"username":"tweezer","password":"yeah its a phish song"}' \
  http://localhost:3000/api/v1/user/auth
```