- remove password from user registration's response
- GET api/users/ list one user
- api auth sample method
- user username for user identification, displayName for user name
display
- save user token's hash into the db and send the original to the client
instead of sending the hash and discarding the original
- move access-token checking to the user model
- strengthen password hashing (somewhut)