more progress on auth, add /users/me route