Finalize API: simple cookie/auth_tkn header authentication, add to-dos RESTful interface.