Api authorisation

Closes #63 
Hmm, good point. perhaps we could use 403's.

For the codes, Koa actually does this quite well. We could just use those: http://koajs.com/#res-status-