Feature: Token based auth

We want to get rid of the dependency on sessoins and cookies in the api. This pull request adds token based auth as an alternative mechanism. If it fails it will still fall back to session based auth.

We probably want to pick the right mechanism based on whether using the API or the web interface later on.