Separate models file is unnecessary
Better authorization checking
Combine User and ApiKey models/tables
Return user object json when authed (includes API key)