Standard session auth; api key model
Server side implementation of authenticate_and_authorize with tokens
Expose access_token to client after login; capture token on client and add to headers after login; remove from headers on destroy