add support for user sessions

- auth via 'user/auth' with email and password
- 'posts/all' restricted as an example
- end session via 'user/deauth'

- Also, created new migration for previous schema changes
- updated docs
didn't work for me. i read up about it and apparently rails/rake really wants you to use migrations for schema changes.
maybe i was running the wrong command but db:migrate and db:load didn't work and/or overwrote any changes to schema.rb