added authentication for api key and user

added authentication for api key and user through middleware and
sessions.