s/user_infos/user_info/g
use class names as auth names, rather than inventing variations
move SessionConfigResource to its own module, since it's not auth-related
reorg docs to break out auth classes, auth docs, and avatars.
edit auth.rst

This includes a more explicit description of the HTTP transactions, but
is otherwise pretty much the same content.
document server-side session contents