Module users 

Signup, login, /users/me, logout.

Upstream: src/Routers/UsersRouter.js. Two facts shape this module and both are easy to lose:

• POST /users is not POST /classes/_User. Only the signup route returns a session token. Non-master class writes are refused, while an allowed master write still has to pass through the same password and ACL preparation as signup.
• The password hash must never reach a response. Upstream reattaches the hash onto the object as password and strips it in exactly one place, so every response path depends on that one step running. Here the hash is never placed on a response object at all, so there is nothing to strip and no path that can forget to.

Functions

login

POST /login.

logout

POST /logout.

me

GET /users/me.

signup

POST /users. Signup.