limit assessments api routes
reorder routes
dont store session in token auth
add api token auth management