Removed rails-api gem and added session management ...again

![](http://media3.giphy.com/media/6hRvaX5iHJagM/giphy.gif)

*TODO*
 - [ ] http_only
 - [ ] remove ApiKey model
 - [ ] move cookie secret key to env variable