API Security

[Ardnived]

Implements #25

In this PR a few things are implemented

• rack-cors gem to set CORS headers
• rack-attack gem to throttle excessive requests
• A new AccessKey model will stores a labeled API key.
• Administrators can create/edit/delete access keys in the CMS.
• All API requests check for a key parameter and return an error json if none is found, or if the provided one doesn't match any key on record.
• GET, HEAD, and OPTIONS requests are not checked for an API key, but still subject to throttling.

I've also fixed the Rubocop configuration, so you might start seeing a lot of style warnings around that need to be corrected.