WIP: Fix access token, and checking access for correct account

* We need to check access for the passed $account not the active user
* We need to allow POSTing using access-token, thus moving it to the http header (otherwise it will be part of the request, and then it will throw an exception)
* Allow browser to send preflight OPTIONS before POST
@mateu-aguilo-bosch what do you think about this one -- along with the user info when you login, you also get the CSRF -- so we save a request.