Api authorisation

Closes #63 
Actually @devcritter it seems that the order doesn't matter. The DB know how to structure these correctly: [doc link](http://docs.mongodb.org/manual/reference/method/db.collection.find/#combine-cursor-methods), [stackoverflow questions that let me to this](http://stackoverflow.com/questions/4421207/mongodb-how-to-get-the-last-n-records#comment23700247_4425163)