authenticate devorator no longer creates APIExceptions... leave this up to the api callback functions so they can do validation first if they want or choose a different http response code. g.user will be none if authentication fails and the callback will handle it as it sees best