Update the title for the API page
Add new marker interface for a digest method
Remove logic from security.userid

The logic should have been contained within the authorization policy,
that is where it now lives. This function is now much simpler and
cleaner.
We no longer "serialize" the x-api-token

This shortens it significantly, and really has no downsides associated
with it. It is also much cleaner this way.
unauthenticated_userid is now a no-op
authenticated_userid now does all of the heavy lifting

This includes all of the logic that used to be in security.userid that
has now been moved into a more appriopriate place.
Look up an user using only the ticket

Before we could also match by the principal included in the request,
this is no longer the case.
Update model to the new world order

- Ticket column is now unique/primary key
- The index is no longer required
- Function for fetching ticket has been updated to not require the
  principal
Tickets should be simpler

No longer are we using a serializer that contains more data than
required. Using random data that is sha256'ed should allow for more than
enough users to have unique API keys that it is a non-issue. Using API
tokens that are longer than 128 bytes was cumbersome and problematic.
Forgotten import
self.request was never required to be passed
Tickets are no longer multi-line
Only return sites the current user has access to
Log an error message if the site requested is not valid