Add User & AccessToken models and enable ACLs.

/to @raymondfeng  please review

/cc @sphess All methods of the `User` model require authentication. Once you are logged in, you can get the data of the current user via `GET /user/{accessToken.userId}`. This should be hopefully enough for your tests.

See also unit-tests in loopback-angular for inspiration:
  https://github.com/strongloop/loopback-angular/blob/master/test.e2e/spec/services.spec.js#L121-L181