API + authentication with devise