move GH and Slack auth to API Gateway

[marcelkornblum]

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html

possibly could allow #12 again, at least for non-auth parts of the app

[marcelkornblum]

this might be useful? https://github.com/serverless/examples/tree/master/aws-python-auth0-custom-authorizers-api