v0.27.0 — authentication

Session-based auth, tying together the session + hash primitives:

setUserProvider((id) => db.users.find(id));  // once, in a provider

if (user && await hash.verify(user.password, password)) {
  auth().login(user.id);
}
auth().check();  auth().id();  await auth().user();  auth().logout();

Protect routes with the authGuard({ redirectTo? }) middleware (401 for APIs, redirect for web). See docs/authentication.md.