Add support for using API tokens for authentication.

This introduces new auth and webapi auth backends for performing API
requests using an API token. Users can have zero or more API tokens
linked to their account, and any will be valid for authentication. The
goal is to allow tokens for different access levels (read/write,
read-only) and, down the road, scopes.

Clients can use these when talking to the API by passing
`Authorization: token <token_value>` in the request. This will
authenticate the owner of that token for the API requests.

Tokens cannot be used to authenticate through the website.

For now, tokens must be created through the admin UI. Further changes
are coming to make the usage of tokens more practical.

Reviewed at https://reviews.reviewboard.org/r/6079/
Add web API for working with a user's list of API tokens.

This adds new web API under /users/<username>/api-tokens/ for creating
new tokens, updating existing tokens, getting tokens, and deleting
tokens.

Only the owner of the tokens, and superusers, have any access to these
APIs.

To get the docs to generate correctly, I had to add support for a new
'verbose_name' field, in order for the document title to not turn 'api'
into 'Api'. Some other tweaks also had to be made to handle working with
the session state.

Reviewed at https://reviews.reviewboard.org/r/6080/