The client is now able to do the following:
- Specify a password digest when creating a new user
- Query for the digest salt
This means that the client can now use the same salt and password combination to regenerate the exact same hash that it provided when creating the user.
This means that when the client wants to perform an action that requires authorization (such as updating its own profile), it can send its email and the digest to the API server, and our server will try to match them with the database records; if there's a match, the user is authenticated and the action is allowed to go ahead, otherwise, an error response is returned.
While globally carrying out this authentication process on each request would work, it is not ideal ...
