The api is functional, although many things are not yet done like token
blacklisting and SSL, this is good enough to start front end development.

I tried to design the underlying logic to be foolproof, and i've run some
tests but i don't consider this to be thoroughly tested.