Private API

Made the API private, meaning you have to be logged in. We also switched to angular_rails_csrf and ditched bower-rails for regular bower. Fixed some naming conventions as well.