fully functional proof of concept minus sessionids

- requests redirect to auth server
- auth server does auth, sets auth_header, redirects to api server
- nginx reads session id from request, looks up auth_token, sets auth header
- api server allows allows

This code needs so much cleanup, though. It's one giant hack.