User authentication

Add ability for users to log in and log out. Resolves #10 
I don't understand the `null: false` constraint on the `remember_token`.  Can't a user be logged out and thus not have a `remember_token`?  If the `null: false` constraint is preferred, then the `remember_token` could be set to an empty string.