change route handler names to be more CRUD-y
don't return password on get users
housekeeping
make ObjectId available in exports
initial implementation of receipts routes