Add API authentication, closes #6