add support for user sessions

- auth via 'user/auth' with email and password
- 'posts/all' restricted as an example
- end session via 'user/deauth'

- Also, created new migration for previous schema changes
- updated docs
http://guides.rubyonrails.org/active_record_querying.html#retrieving-a-single-object
This says it throws if not found. no?