Make a basic User model (including secure passwords.
Finish user signup.
Add SSL in production.
Finish sign in.
Finish updating users.
Requiring signed-in users.
Requiring the right user.