zosima/website — pull request #1 by paulcbetts (2013-12-31 07:19:56+00:00)
Title: Create Authentication

This PR adds an authentication layer to Zosima, via the G+ signin button. It works a bit differently than traditional session-based authentication, because this makes it easier to interoperate with Android (as well as makes the web server way dumber, which is Good™).

1. The client side retrieves a **Google** OAuth2 access token, via the [Google+ SignIn button](https://developers.google.com/+/features/sign-in), all in JavaScript
1. The JavaScript API makes a POST to `/api/logins`, with the Google OAuth2 token `access_token` as a parameter.
1. The server side then tries to take that token and get the profile information - if it succeeds, we know that token is legit. We then generate a **Zosima** token, and return it.
1. Now, the client side JavaScript can call Zosima APIs using that token (and save it off in local storage)