Sign all API requests with a user specific key

[aaronlinsky]

We need all requests to the backend to be authenticated before processing. This prevents a malicious actor from claiming they're user_id=x when they actually aren't.

1. During the create user flow, generate an asymmetric key pair when the fcm token is created. Store those keys in the same location on the device that the fcm (and later user_id) is stored.
2. Send the public key to the backend service in the create user call.
3. For all subsequent calls, sign the request contents with the private key.
4. The backend services will verify that the requests are actually coming from the given user.