OAuth flow

[asyrique]

tying user IDs to bins

[asyrique]

This needs to be thought on a little, especially with regards to the separation of concerns between the CMS and the API. How much of auth should be handled by the CMS and how much should be handled by API