Onion Architecture and Authentication

I have developed single MVC Projects, but not layered and onion stuff.

 

Here is the pattern/structure i am trying to follow:
> Core Project
   - Entities
   - DTO
   - RepositoryInterface(GenericRepository + Individaul InterfaceRepository like IProduct,                                                       ICustomer)

> Infra Project
   - Repositories (Implemenating RepositoryInterfaces)
   - Migrations (Code First Workflow EF 6)
   - Mappings (using AutoMapper)
   - DbContext.cs

> Test Project (NUnit)

> WebApi 2 Project
   - Controllers with UnityDI to Constructor
   - Token Based Authentication(?)

> MVC 5 Project
   - To give out Views
   - Authentication (?)

> Xamarin Project

My questions are as follows -
1) Am I going in the right direction?
2) Is it Okay not to use UnitOfWork?
3) I am really confused about Authentication. How should I
authenticate my users and web api?
Forms Authentication for users in my app? and token based
for web api?

Any suggesstion/links/advice are welcomed.