[feature/api] Rough implementation of API authentication

A rough implementation of API authentication. The application
can request 2 tokens, one authentication token and one signing
token. The application prompts the user to allow access using these
tokens. When making a request, the application should take the
API route and sign it using the signing key using HMAC-SHA256,
for example signing: api/auth/verify/*apitoken*/*timestamp*
then add the resulting hash as the last parameter. The server
does the same calculations to check if the hash is correct.

PHPBB3-11595