add token auth to user
add auth to assessments api
limit assessments api routes
reorder routes
dont store session in token auth
add api token auth management