Auth improvements

[bdharris08]

Right now, you need to have a AWS access key to talk to the api.
In a real production project, we might use a custom JWT system with a lambda, or just use cognito.