API put & delete

This commit adds the PUT and DELETE commands and preliminary
authorization testing that supports either an "auth" cookie or an
"x-auth-token" header that must match a token stored in the user
database.