initial work on auth and api
fix token auth
add locations, spots, and fix auth
spots with locations working