HTBox/crisischeckin — pull request #218 by brunck (2014-10-12 05:28:17+00:00)
Title: Issue #209 - Implement API Authorization

Implemented basic authorization for our Breeze API. There was talk about not using username/password to authorize, but since we use the simple membership provider, this is very difficult to do (may require replacing the simple membership provider). It really needs a way to log in and expects that to be in a plain text name/password combo.
As it is now, we pass in the username/password separated by a pipe (|) character, using Base64 encoding. This obfuscates the data but it is not currently secure; that requires HTTPS.
Since we don't yet know how we will proceed with the mobile clients, and we don't know if we'll stick with the current authorization scheme, this should do for now. We can always refactor later.
The rest of the API can be fleshed out later too; it's a little tricky to know exactly what form we'll want it to take until we figure out what we want to do with the mobile clients. We can still do this at any time and write tests using the ClientModelTests fixture in the acceptance tests assembly. This is not dependent on the mobile clients if we decide we want to go ahead and flesh the API out first.