Clean up per R# suggestions
Change ApiSession to tie to user.

I incorrectly made ApiSession related to People instead of Users
originally, but an API session is tied to credentials (aka a user
login), so this change is necessary.
More R# suggestions.
Introduce ApiSessionModel, etc.

For API calls (specifically mobile related), a new SessionToken will be
used after a successful login with credentials. It will then be used
instead. Each session will have a 30 minute expiration, which will
require the end-user to either re-enter their PIN or credentials. (note
that this functionality doesn't all exist yet).