Device auth

Add device auth for `/results` (but for no other url). Needs:
* more thorough testing
* extension to other urls
* generalization of auth with user and device too