[api] allows authentication with an 'api-token'
[dist] bump v0.3.8