Rest api

- allow an access token to be requested based on a given client ID and a client secret
- allow an access token to be used to make calls to a REST API