New setting: AUTH_TOKEN_MODE

If REGEN_EVERY, a new token is generated on every request. If
REGEN_NEVER, tokens are never altered after the initial authentication.
The latter helps with testing.

Also: return hmac token so node server can check hmacs
api examples
nm
API adjustment; formatting
store hmac token so we can check hmacs
task model
Move csp below public so we can use halbrowser
require hmac; use generateHyperMedia
include security info in root
define security information

secured-by and hmac information is stored here. I don’t expect clients
to actually parse the hmac info, but it’s there in case anyone wants
to. secured-by on the other hand is parsable, but that’s not required
(but not doing so increases fragility)
get tasks; require hmac
securedBy -> secured-by, hypermedia now includes top-level security info
object utilities
add crypto-js