Fixes and simplifies API authorization
Fixes and simplifies API authorization

Subjects now auth via Session (slower, but accurate) and all
authorization has moved to api_auth().

nocko/cfmi,nocko/cfmi,nocko/cfmi