API v1 spec

This is still a work-in-progress, but any feedback is more than welcome.
@bcwaldon No, you encode whatever cursor metadata into the token. The client treats it as opaque.