API controllers should add surrogate key for current user to allow access revoking
Added instructions how to configure support of X-SPREE-TOKEN