API has now a oAuth2-token authentication which first checks if the POST has a correct token and then checks if the authenticated user owns collections and material items he wants to modify. If yes, proceed, if not, cancel.

Code needs testing and cleaning and GET functionality should probably be reviewed.