Require User Authentication to App API

And throw a 418 on authentication errors as nothing else seemed
appropriate (and it's cute)