WIP(api): session management
fix(api): skip user model password field
fix(api): NewUser -> InsertableUser
feat(api): user model