Authentication

Authentication/authorization backends belong in haas/auth_mechanisms .  It's
possible that the API of that plugin will have to be expanded to cover what
the CLI needs to do.


WIP
please use .[one()](http://docs.sqlalchemy.org/en/rel_0_9/orm/query.html?highlight=one#sqlalchemy.orm.query.Query.one) instead of .first() to be safe. A username having multiple entries is undefined and therefore we should air on the safe side and reject it.

You can then use try/except to process the user-not-found race or recast the multiply-defined user as some other type of exception.