changes to server-side authentication logic. Basically added Forms Authentication so the requests are authenticated and it all works as it should be.
Also added base class where all API controllers require authentication in order to provide more security and loosen it as required. This base class also contains the currently logged in user.
Note that web.config also changes, the changes to it are used to configure the AspNetMembershipProvider.