Session handling

Closes #15 by creating a SecuredController with a before_action filter to handle Authorization header. UserAwareController and all other relevant controllers are subclasses of SecuredController, thereby forcing Authorization for all requests that need it.