Add devise!
Get json authentication working
simple (unsafe) token mechanism
more secure token auth method mitigates timing attacks