Cleaned up UserController, the return statement was never reached, and the else was superflous.
The postUserAction method was a placeholder during testing
Changed auth mechanism to be 'two-step'.
The client requests authentication from the /user/auth route, using the user's password as the secret.
This will, in time, create a session key, which can then be used for future authentication of the user.

Only the session password should give access to functionality, the user password only gives access to generate a session password.
This means that the user password, even though it is hashed, will only be sent over the wire as few times as possible.
The session password can be changed whenever necessary, the client just has to re-auth to get a new password if it is compromised