Ok I need some external motivation to finish this thing so I'm putting my plans and questions in the public for now.

The main thing that Abuelo needs to do is to authorize other applications to access some or all data stored in Abuelo itself. The main way I'm thinking of accomplishing this is something along the lines of:

Application (let's assume A-Chat for now) makes a GET Request to /api/auth
Abuelo responds by sending down a code which acts as a temporary identifier
A-Chat then presents the user with a login screen
-Somehow these credentials along with the identifier are then transmitted back to Abuelo through a POST request
Abuelo responds with a more permanent handle that represents the permissions the application has
A-Chat can now use the handle to get whatever info from Abuelo it needs.

There are a number of problems with this approach. First, is that transmission of credentials part. In the database, passwords will be stored as salted hashes for security sake. But when A-Chat shows the user the login screen; should it hash the password then transmit, or transmit the unhashed password? The problem with the former is that two unrelated pieces of code would now need to be kept in sync and while the latter has the problem of the raw password being in transit. "Oh but HTTPS solves that", if we want an A-Chat client on AbleOS itself then we'd have to implement HTTPS instead of plain HTTP.
Second problem is permissions. Assuming that we don't want Abuelo to give everyone everything (an open question, how much is Abuelo gonna store in the future?), we'd probably want some sort of permission system.

There are still some open questions here but I'm gonna start work on some of the CRUD interface for the users tomorrow.