fixes #2988 - merge authentication code, enables REMOTE_USER auth on new API controllers