Refactored string constants path names. Added additional functionality to exception handling to allow non api exceptions to have an appropriate api base exception type. Altered authentication logic to return json string rather than security header. I also altered the authentication module to create a 'salt' and 'initialization vector' for each session. This allows every session to have a unique encryption/decryption key, while protecting the client's key.