Switch 'User' to 'Admin'

Going to separate users from admins for now, since they might be quite
different.
Add ability to request auth tokens via api

For now we're passing a secret back to the client over SSL so we can do
secret-based request signing, since that's simple and effective.
Warden strategy for logging in api users via oauth

Now, users may use oauth to access our API. Currently this API only
consists of a time function and a relatively insecure way of getting a
shared secret (insecure because anybody could request a secret for
anyone).
Protect API key generation with basic auth

Previously, anybody could access or create keys for a facebook user,
only knowing their facebook user id. This heightens security a bit by
limiting access to just those with the user/pass, and only creating new
keys rather than optionally returning existing keys.