Move auth helpers to helpers file
Move /api/ routes to their own Sinatra app

This has a number of advantages. Previously, you had to dig around in
MainApp to find /api/ routes, so this change improves code organization.
It also allows testing of API routes completely independently from
MainApp.

One minor improvement: I was able to remove API-specific logic from
`before` filters and simplified them.