Refactor api auth

This cleans up some of the API authorization in the hopes that some of the internal authorization logic within the API BaseController can be moved to cancan at some point in the future.

This change is not intended to modify any functionality.  Tests path both before and after these commits.