User notification list api

This is a wip, but I'd like to get feedback on the user authentication part[1]. There was a surprising amount of moving stuff about to get that in place, so this is a good checkpoint.


thanks, this was originally in a different spot that was more indented.