Feature/api auth

This is a backwards incompatible change - deploying this will break existing clients ability to create fountains.

https://www.pivotaltracker.com/story/show/67121414