Auth routes

Not quite sure about the names on these, but the fields and comments are there. Definitely open to alternative names for the messages.

Once these get merged Android and iOS will have to use them for sign in/sign out. Everyone on the mobile teams please take note of this.

Web team: only change for you is a route change and its no longer a GET/DELETE. Changing to POSTs to be consistent with the rest of the API. This will go into effect the same time that session tokens get deployed (I hope).

@maconsuckow @atscott @moorea @nockertsb @MariusVolkhart 
would prefer userId