User auth thru POST /sessions
Add expires_at to ApiKey
Only allow users with valid token expiration date