HTTP AUTH and API fixes and clean ups

Changes here include:

HTTP AUTH for handling authentication when a deployment is in private mode. See #984
Fix issue with media tagging via the API
Add a check for an existing ID before tagging a media to it via the API
Refactored tag media to make use of $this->set_error_message() instead

@rjmackay Mind a code review again?