Explain auth/access/priv system??

Hi -
    I'm new to postgres and have some questions regarding the
authentication and access systems.  I've got postgres installed and can
connect from remote machines, but have some questions:
- I cannot connect as the postgres user 'postgres' from remote machines?
Why?
- How is pg_shadow managed?  Is it built from the pg_user table?  If so,
how do I clean it up (doing a "strings pg_shadow" shows users that no
longer exist -- is that a problem?)
- In the docs under "Database/Table Privileges" it says "TBD".  Can
 someone fill me in a bit.  For example, as 'postgres' I did "CREATE
DATABSE foo".  Then I created the user "foo".  I would have thought that
I would have had to grant some sort of access to user "foo" to database
"foo", but as user "foo" I was able to create tables in database "foo".
Why?
- What do I need to do in order to allow multiple users the abililty to
  create tables in a single database?
Thanks!
-philip