We're not testing the redirects anymore. But the error messages should be pretty clear already. We can start testing redirects again once we redirect to different places for different actions.

Also save debug log on failing features

We have an ApiController that wants to call #fetch_user. Since we can only inherit from one class i moved fetch_user into an extension.

require_login is require_token for the api controller

It also skips the verify_authenticity_token before filter.
So all Subclasses of the ApiController will only support token auth.

Also made the V1::UsersController a bit more strict. Now way for admins to alter other users through the api. We don't support that yet so let's not allow it either.

Also added authentication steps to cucumber