Expand `apipass`.

`apipass` parameter with a recognised token is treated like a valid
session cookie. So things like `http://lrrbot.mrphlip.com/api/show/<show>`
can only be used with proper authorisation and locally testing mod-only
pages doesn't need changing `login.py`.

`apipass = "Password1"` in `secrets.py` needs to be replaced with
`apipass = {"Password1": "lrrbot"}`.