initial implementation of Tonic framework for handling API requests
switch to PHP session-based authentication
web client changes