Feature/auth

Hey doug, please leave the checkAuth function in userController. I've left it partially finished because it depends on input from the client (the re-sent jwt tokens). Once we have jwt's sent from the client, I'll be able to test it and finish it with another PR.
`!(newUser && password)` might be more readable (one fewer logic step)