November 12

## What changed

 * Found a whole bunch of todo items, most notable the fact that `token_authenticable` was deprecated in devise 3.1
 * Added very basic authorization logic for retricting access to controller actions based on user permissions

## Other stuff

Last night I was able to control an IO pin on my Arduino via HTTP request. Although blinking an LED is not really a big deal, this does mean that we are really really close to getting an API that can control physical hardware via REST. Woohoo! I will post the source code to my Github account when I have the time.