Omniauth strategy for API user authentication