Api authorisation

Closes #63 
Should we think about using constants for all codes? So `status = code.FORBIDDEN` or something, I'm sure node would have the constants defined somewhere...