Require basic authentication for user/token management

Implement stricter security for token based authentication. Creating
tokens, viewing tokens, creating users, and editing users is only
allowed with basic authentication using login/password. This prevents
escalation of a security incident where an authentication token is
stolen.
If this is not in place, an attacker with a token would be able to
change user passwords, add new users, or view other tokens, making
revoking of the token ineffective.