note some changes needed for multiuser support

HACKING.md

@@ -30,6 +30,25 @@
   or above a particular intensity. Indicate somehow the length of
   each continuous stretch at that intensity
 
+## Multiuser
+
+I am minded to avoid writing any of that user registration/authn stuff
+and just use a third-party SSO thing like Authelia to cover password
+resets etc.  Installation instructions will include "set up a reverse
+proxy for this app which sends Remote-User and other Remote-* info as HTTP
+headers".
+
+
+However, we do still need some changes
+
+1) trackpoints are no longer unique by time
+2) also sessions
+3) we want a `users` table with id and name/fullname/email to tie them back to
+4) if there is no userid for the current Remote-User header, make one
+
+
+
+
 ## Sessions