Change auth

Don't merge yet; this is just an experimental idea of how to do authentication. 
We could also still put the user in the environment, which is the App Engine standard.