Introduce authentication and basic authorization in the server.

- When enabled, all requests must be authorized using an authorization token
- Token is acquired by authenticating with a username/password tuple.
In concert with the following comment, perhaps it would make sense to document IllegalTokenException as being thrown when invalid characters are encountered and to have a new exception, perhaps DuplicateUsernameException when there is a username logical constraint violation. It could be that both these exceptions extend a base one that is declared here, so the implementing class can pick and choose the exceptions it throws.