User notification list api

This is a wip, but I'd like to get feedback on the user authentication part[1]. There was a surprising amount of moving stuff about to get that in place, so this is a good checkpoint.


see I do care about that @brandur