lock down API to authenticated requests only
setup shortcut routes to /logout /login and /me
build basic angular app and add authentication against API