In which we handle basic user creation and authorization 

We'll need to customize the default log in and account creation pages, but this should be more than sufficient for local development.  Real user management isn't slated until the second milestone, but we need something in place because new resources get linked to their creator, which means at least having the app know which user a request is coming from.

Even if you have no comments, some "okay" that says you've looked at the changes I made to the API doc and think it's all right would be super.

@maiamcguinness @bunnyblanco