add user auth, admin auth, password verification and token expiration date

don't leave commented out code in your PRs