Re-architect server API auth handling

[gjedlicska]

• [ ] come up with currently used schemas, where its good, where it isn't
• [ ] some get some research in
• [ ] create an auth workflow diagram that can be implemented