Model for authenticating API

So we can have write APIs (not yet implemented) for offseason events, like Chezy Champs.

This allows us to dish out IDs and Secrets to give write access on an event-by-event basis. The ID and Secret will be passed along with any API call to authenticate. It seems like the biggest issue is that the ID and Secret can be exposed unless we have SSL, though someone with more background in security should take a look.