added api authentication
pain in the ass rails routing in the way, but moving forward with proper sessions and tokens