major refactoring
added token authorization
moved transactional method to services
secured all methods in controllers
Merge remote-tracking branch 'origin/master'