API auth & other restrictions

[m-mohr]

• properly implement authentication
• rate limits
• site hosted on AWS? set limits through AWS?

[asmithml]

While refactoring the code, I decided to add some additional middleware for the application. As part of it, I included some security header middleware to prevent basic exploits. The auth items will be addressed in a standalone PR in the near future.