No need for before_action
Accept api token as http basic auth password
Accept (temporary_)username as http basic auth username
AMIGA RULEZ!!!!!1111