Introduce authentication and basic authorization in the server.

- When enabled, all requests must be authorized using an authorization token
- Token is acquired by authenticating with a username/password tuple.
This should probably be volatile, since it's reassigned in `save`, which is `synchronized` sure, but it would be for `numberOfUsers` and `iterator`.