feat(api): add authentication

While there's nothing sensitive being provided by the API right now,
this effectively enforces that this is a private API and that it might
change at any time.