Rename V1::ApplicationController => V1::ApiController

and add test to ensure user is required to authorize