Return 401 on no-auth when requiring admin.
Ensure dates are stored in UTC.
Prefix all routes with /api.
Rename {privilege}->{role}.
Convert forgotten now->timezone('UTC')...
Prefix forgotten route with /api.
Move resources directory.
Correct kwarg for admin.
Validate slugs as slugs.
Fix 401/403 status codes for article fetching.
Return slug with tag representation.
Remove password from users.

Users no authenticate with a Google-backed OAuth2 workflow (other
providers may be supported in the future).
Add CORS headers to backend.
Revert CORS headers update.
Send email on verification.
Promote first user to admin role.
Convert username/slug lookup to use uuids.
Ensure exceptions are serialized as JSON.
Add verified/unverified to users route.
Remove UUIDs from database.