Introduce authentication and basic authorization in the server.

- When enabled, all requests must be authorized using an authorization token
- Token is acquired by authenticating with a username/password tuple.
Went over this and added IllegalUsernameException. Meaning, the interface now allows the API consumer to check up-front if username and token are valid, but still also forcefully fails if invalid names or tokens are given to #save(). I think this is the right approach, because it avoids exceptions for flow control, but remains safe by not *depending* on the user performing the manual checks.