api_key will be used to validate client and not users
returns not_authorized if login fails rather than returning a useless token
limits user actions to the context of the currently signed in user
creates a fake redis for testing purposes
adds model specs for AccessToken