User accounts

[JamesRamm]

Create & enforce user accounts (make v simple - email & password), so models can be given more provenance and allow more filtering.

User Description

A user is just an email and a password. All routes will be authenticated only; all users will have access to all routes.

Model Ownership & data access

A Model will have a user related to it, but this does not affect permissions; all models will be visible to all users.

Endpoints

login - login with an email and password
change_password - change a password (once logged in)
remind_password - send an email password reminder
register - register a new email and password.

The tucluster configuration settings will state whether the registration endpoint is open or not.
This is a simple approach to managing registration which could be expanded in future.

[JamesRamm]

I'm in favour of a phased implementation, whereby intially a user is simply just an email and there is no authentication.
A client may choose to abstract away having to enter an email for each request by showing a 'login' page and then storing the email, but there would be no need for auth.
This allows for a faster turn around and initial release and more thought into what routes require authentication and what authentication method to use