Set up authentication for API: change routes, add token authentication to models and controllers