Add authentication based on token or username/password
Get cookies working; start using token auth in API