We now use the users email to identify him, since the ID doesn't work via Endpoints.
See https://code.google.com/p/googleappengine/issues/detail?id=8848
Implemented authenticated API requests and the Watchlist.