better authentication

- make only non-deletable admins create admins
- make it forbidden to use admins' logout unless admin
add available_username with specs
better authentication
refactor
better authentication
better authentication
better authentication
refactor
refactor
almost finish authentication
almost finish authentication
refactor
update gems