User model, route, handler, and authorization skeleton