moved all the auth stuff into one before filter which looks for header auth first, then falls back to cookie auth if the request is same domain
cleaned up, and tested the flow, still need to make some buttons turn off when not signed in