added device authenticate to the api, so that devices can obtain api tokens