[WIP] User Authentication, API Handling

Is this storing a plaintext password? We should be storing a 1-way has (eg. with `bcrypt` or something similar)