Add users.json, token auth, misc fixes.