User notification list api

This is a wip, but I'd like to get feedback on the user authentication part[1]. There was a surprising amount of moving stuff about to get that in place, so this is a good checkpoint.


Interesting approach! I do have to say that we normally authenticate in the leaf endpoints themselves as opposed to middleware just in case an endpoint that allows unauthenticated access, or uses a different authentication scheme, is desired.