closed #18 client authentication

An issue I ran into with this:
In order to *not* protect the root API URL (/v1), I added a regex to ensure if API Keys are enabled, that the URL must start with /v[1].+. This means that all the tests needed to be updated to request /v1/ or the api key authentication would not work. There may be a better way to do this.

The documentation needs to be updated regarding API keys.
Like the comment from line 62, I think the test description should be `"should return 401`... instead of `405` given what the helper function is doing.