models: some comments on required attrs to APIToken
auth: prevent API leakage by introducing an AuthnedInterface