added "GET /users/<username>/auth/<passwordhash>"