Added optional OPENBADGER_LIMITED_JWT_SECRET env var.

Iff an api endpoint is accessed using this secret, then `req.authIsLimited`
is `true`.

Fixes #210, which disgusts me.