solved a terrible security issue and regenerated the rails session key
controllers and views refactored to reuse authentication code with api
auto-generated api key added to all users