moved authentication to custom auth middleware
added hashing for keys, key timeouts etc.