add support for user sessions

- auth by providing email and password to 'user/auth'
- as an example, restricted 'posts/all' to logged in users
- end session via 'user/deauth'

- also, created a migration for previous schema changes.
- updated docs