Added first API controller for Candies

We're using the api-auth gem to do the whole access_key/secret dance.
API is naturally versioned and users get given a key/secret pair upon creation
Candy controller basically working