API stores oauth token in session

In order to limit reliance on the API server, the client should supply the google oauth token with every request.
The API should be session-less and blindly use the token passed with the request.