User notification list api

This is a wip, but I'd like to get feedback on the user authentication part[1]. There was a surprising amount of moving stuff about to get that in place, so this is a good checkpoint.


I got this pattern from @deafbybeheading. It's a good point that it sacrifices flexibility, but on the other hand, it does make it nice to know that everything is solid after that, and makes testing the endpoints not have to test auth too.

Something to keep in mind though for sure.