3413: added TrashHandler

* added a trashq WorkQueue to manage the trash list
* added TrashHandler to process "PUT /trash" requests
* added TestTrashHandler
What do you think about combining these two lines, so that it's clear that the `api_token` is not needed after this point.

If you're not comfortable combining the lines, another option is to place this section in a block to make the scope explicit.