Auth fix

is_navigational_format? thinks our html feed requests are coming from an interactive user.  to accommodate the confusion, we can check the request for a token.  Devise doesn't use them anymore, so if there is one, it is an api request and we'll let the api stuff handle authentication.