Add permissions to users.
Only let users with permissions access the respective API.
Move configuration into database. Make configurable.
Rename ConfigurationsController to ConfigurationController.
Ensure that the user is logged in and has perm before showing config.
Enable managing user model via a CRUD interface.

Via https://github.com/plataformatec/devise/wiki/How-To%3a-Manage-users-through-a-CRUD-interface
Create users controller.
Allow admins to edit and destroy users.
Allow editing without changing password.
Don't allow me to delete myself.
Only allow the config to be viewable by all and restricted otherwise.