Add proper authentication

[DylanJones]

Currently, we don't have any authentication around creation/deletion endpoints. We need to add proper CAS auth before we release the first version.

There is code in place for authentication, but it's somewhat broken right now. Whoever picks up this issue just needs to fix the already existing authentication code to actually work.

Note that this does NOT cover adding a login UI, only protecting the API endpoints.