Boatload of Express user auth improvements