Authorization

This mostly has to do with authorization:
* When you log in on Node, it will also log you in on the API (excpect not yet because we're using self-signed certs and it didn't like that). 
* The tokens are stored in the TokenService. 
* All headers on the vendor app provide a facebook or twitter authorization.
* All headers on the vendor app also have 'Accept: application/json'
* All POSTs on the vendor app have 'Content-Type: application/json'