Include and set a default sort order
Associate models with users and check for auth

Check for login on all auth-required pages and redirect if the user isn't
signed in. Extra Pundit check for scopes/authorization on virtually every
DB call. So things are getting there re: security.

 * Fix #84
 * Fix #87