User notification list api

This is a wip, but I'd like to get feedback on the user authentication part[1]. There was a surprising amount of moving stuff about to get that in place, so this is a good checkpoint.


Whitespace. (If you're into things like that.)