Make auth.has_permission delegate entirely to User.has_permission
Show error flash messages along with info messages

Add some styling too.
Rework auth a bit

- Set User.password using plain text; the plain text password will
  automatically be encrypted via an event listener.
- Allow a salt to be passed to auth.hash_password().
- Add a function that just compares passwords (plain text to hashed) so
  this logic can be reused throughout: auth.passwords_equal(). Makes
  use of auth.hash_password() by passing the hashed_password as the
  salt.
- Only allow canonical user IDs to be passed to
  auth.user_id_validator() (the caller of user_id_validator() should
  only know about canonical IDs).
- Only allow non-canonical user IDs (i.e., usernames and emails) to be
  passed to check_credentials (we don't want people to be able to log in
  using database IDs).
- Improve docstrings in auth module.
- Improve error messages in auth module.
- Reorganize auth module a bit for clarity.
Add unique constraint to User email & username columns
Allow users to update info on /profile

Removed /user/{id}/{action} route and UserActions resource. Updates of
user info are handled by the User resource's PUT method.
Fix "came from" logic when signing in