merged deploy fixes (jawbone up HB measures)
don't redirect developers to the dev web app and use cookie authentication to let developers explore the API