Add support for API key generation and extraction

This uses the twp.oauth code to manage bearer tokens which
can then be shared with other tools or used in command line
access. The keys are revokable as needed.

fixes #9

Note that this only work for two reasons:

* tank is SSL
* people should not share their keys

future todo: scopes on keys