Auth

Adds a decorator that authenticates from an `access_token` query parameter. Passes in user to decorated function.

Add to comment: "The wrapped function is called with keyword arg called 'user' that is a user object.