api/register and api/authenticate properly implemented; return a JWT
merge in initial authentication changes