Working user auth, hardend sql for User Model, prep for ACL restricted URIs