user model and end to end auth with token gen and storage/wiping