Add some form of authentication to prevent abuse

To better protect this process and to prevent abuse from bad actors, there should be some form of authentication or security in this app for the base endpoints in this API. This could be in the form of Drupal OAuth bindings, or only exposing the callback to the public and using internal routing to do the requests to create documents.

@cguindon any preference here?