unique contrainst on user.username
username must be an email
store user ID in the session (mongo token doc)
create request user in the auth middleware