store the session username when they successfully auth
make all routes match the token to the user who created it
move findOrCreate into model, ditch findOrCreate route
update the updateLastActive to take id not name
update docs