Completely redo authentication for actually accessing the api

[janka102]

We should use OAuth1 (yes, not OAuth2) with passport http://passportjs.org/guide/oauth-api/

_tl;dw for the video_: OAuth2 requires SSL to be secure, OAuth1 is secure regardless of SSL usage, although more complicated