Auth

Adds a decorator that authenticates from an `access_token` query parameter. Passes in user to decorated function.

Is this guaranteed to exist in a non-error response?