Add API token infrastructure
Add RequireToken() calls in sensitive endpoints
Update API documentation
Fix ActiveTokens-related panic
Use tokens
Require IP validity on tokens
Merge branch 'h.csrf'

This should fix a security vulnerability which was responsibly disclosed
by thefinn93. The vulnerability allowed sites serving malicious
JavaScript to issue NodeAtlas API commands via the IP of anyone visiting
them. Requiring single-use tokens from /api/token should prevent this
from happening on sensible browsers.
Version 0.5.10