Expand `apipass`.

`apipass` parameter with a recognised token is treated like a valid session
cookie. So things like `http://lrrbot.mrphlip.com/api/show/<show>` can
only be used with proper authorisation and locally testing mod-only
pages doesn't need changing `login.py`.

`apipass = "dickbutt"` in `secrets.py` needs to be replaced with
`apipass = {"dickbutt": "lrrbot"}`.