Finish user auth.

Can this be factored out into an auth router?