API Session Tokens & User API tokens

  - Create API session tokens for:
    - guest users
    - users who provide a correct password
    - users who provide a correct api_token

  - Create user API tokens for authenticating with a secret shared
    between the cient and the server, but not transmitted.