api: Setup api controller and authentication

Implementing a devise strategy for the API gets a bit messsy,
so we do the token authentication manually and set the warden
user explicitly.