new auth schema with /login and /logout
major api changes
 - no longer user model refs in the model json, now we just return the
 id
 - all model object now based on Model or SystemModel
 - all models now inherit their json() method from Model or SystemModel
 - we now login and logout via /login and logout
 - only /login accepts the user password, all other routes use the
 access_token return in the user object on /login