Migrate to DB-powered authentication

[alanhogan]

• Migration that adds a users table
• Support for admin users and add-only users
• API keys reimplemented and tied to users (probably one-to-many)
• UI to create, delete, and privelege users & create & delete API keys
• UI to change your password
• Authentication would no longer be via config file, instead via db + bcrypt

this would require a major version bump
this would solve #33 and #34

[alanhogan]

Users could be marked as needing a password change