Single Page Application authenticating to a restful/stateless API