removed sessions, implemented auth tokens, lots of improvements, api docs