house cleaning
- users can have multiple keys - keys are hashed with bcrypt - each key can have its own expiration - each key can have a contextual comment - authentication via API requests happens with the Authorization header
- move the app dir's contents to the source - update composer for easier installation