Namespace the HAWK auth to /api

We need to re org the routes to allow some that don't need
authentication.

Like the routes to exchanged username/login for ephemeral keys