Removed rails-api gem and added session management ...again

![](http://media3.giphy.com/media/6hRvaX5iHJagM/giphy.gif)

*TODO*
 - [x] http_only
 - [x] remove ApiKey model
 - [x] move cookie secret key to env variable
 - [x] add specs