reorganize api/mentions for less duplicate code
support retrieving multiple targets

closes #31

Now you can pass multiple values for `?target[]` when looking for mentions.

This also removes the "private access" concept when fetching mentions of specific URLs. The reason is that most people using this service end up fetching the webmentions from a browser, where the browser needs to be able to have unauthenticated access anyway.

Access to fetching mentions on the whole domain is still restricted to using an access token, to avoid potentially exposing secret URLs on the domain.