Private key generation
Node.js port of https://github.com/wtsi-hgi/hgi-web_apitoken

...The "meat" of it, at least
DTRT with Accept headers
Parity with original Perl script
A kB private key seemed excessive; reduced to 2048-bit
Apache AUTH_TYPE environment variable not being passed correctly as request header...
Fixed Accept header parsing
ePPN and Shibboleth session ID => Shibboleth authentication?

Erm... As these variables are just sent upstream in the request headers,
rather than inherited from Apache, they could easily be spoofed to get a
token, provided one had access to the app. This security hole *could* be
firewalled, but it's easier (thus, safer) to just use the Perl script.
Converted upstream server to CGI script