Initial auth commit.

This is meant to start a discussion on auth and critique on my testing. 
404 doesn't really seem right for a not found user. 404 would generally suggest the call doesn't exist right??? Also 401 is unauthorized, 403 is forbidden which indicates auth won't help and the call shouldn't be repeated. Does it make more sense to return an object like LoginResponse that handles whether the user was found or not? I'm not really the expert on retu