added stack trace to exception output in API when YII_DEBUG is true

issues #303 and #2516
perform API auth before configured User class may require login

This allows usage of AccessControl filter in API
Fixes #2880.