allow users to use either their email or username to signin
add auth_token to users
generate auth_token on signup
use cookies to authenticate users
allow users to be permanently signed in