Add comment about user auth.
Rename app.user to app.users.