Lots of fixes for auth. Closes #34

More standardized error codes, more JSON responses to JSON requests, more abstracted run ownership checking