messy first implementation of Application.authenticateApiRequest

did quick integration testing with a demo connect app, seems like it’s
doing the right thing