moved acts_as_token_authentication_handler_for into API and out of main application controller