got the routes working as described in PROBLEMS
noted failure to validate token in PROBLEMS.md
added sessions route, ctrl, view and spreadsheets service
auth service now stores accessToken in session data
added Authorization header to getSpreadsheet call

as per http://code.google.com/p/google-api-javascript-client/wiki/CORS
added js files in app/scripts