@lefnire => API Auth working + 1 test

So, first off, I should say: I think we should take a serious audit at the security implications here. I'm by no means an expert and this implementation is definitely not rock solid. So, that being said, don't merge this into develop yet. I don't want anyone's data being released on beta.habit. Pull this into a separate branch of your own so you can test it alongside habitrpg-mobile.

The implementation is fairly straightforward, plus I included a test.

```bash
curl --compressed -X POST -H "Content-Type:application/json" \
  -d '{"username":"tweezer","password":"yeah its a phish song"}' \
  http://localhost:3000/api/v1/user/auth
```

https://github.com/lefnire/habitrpg/issues/524