short term tokens
give etherpad an auth token

it will have to call /ajax/token to get the info stored in the token.
fix facebook/google auth