> Password must be composed of only alpha-numeric characters.

Okay, why?

This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something.

It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that.

Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.