initial token based api authentication

still needs to check if the permission for the token holder is valid for
the operation
basic api key management

page on hosting app to request and remove an api key.
use roles for api auth

and correctly handle the fact that legacy users do not have roles or
permissions