- initial login implementation (no passwords yet)
- use username instead of nickname
- filter by Mash.user_id on list