add accounts api
add Session model; generate api keys
move foreign key from account to session
add sessions api
add role to Account
restrict access to orders
give spec contexts a better description
extract resctriction_behavior into restrict_access_to method
Merge branch 'authorization'