Protect user parts of the mobile API.
Add section URLs
Add redirect-to-user call to public mobile API.
Add password reset to mobile.