cleans up user model specs
Merge branch 'users'
adds api key model
adds controller authentication via access token