added devise to handle sessions
added apikey model (but don't use it yet)