just the bones here, not authenticating at all yet. going ahead with the chapter
now because i'm curious about the preferred way to authenticate; are we going to
put this on `UserModel` or some other `internal` locale, or just in `helpers.go`?
deliberately skipping salting and encrypting passwords at this point. intending
to approach this in tandem with authenication.
also starting to want db migrations, but trying not to get distracted.
