Add remember me
Make logic more secure for remember_me
Only expose api_key on current_user route