Add a user model and generate auth_tokens

Auth tokens are not used to restrict access to other stuff yet, but will be very soon. For now, just create new users and store the auth_token, and include it in every request, then it won't break for you when we start restricting access.