Tie token for session to specific user

- match token generated during auth to the user, so tokens are only valid for the user that generates them
- made the auth do the creating of the user and just send back the username and id along with the token
- update the routes, don't need `/users/findOrCreate` anymore