Store user id in auth token

Closes #20. Save us a bunch of db queries. Although ideally we'd also
invalidate the old tokens while we're at it? Eh, they'll expire.