authorization models, sessions controller comment for format of auth request
authentication stuff and sending back nested user stuff