made the auth token better, and auth directive now checks user using token that matches email
verify auth token is 'good' by checking email matches and it is not expired
just some renaming, and fixed tests
added upload photo json