add simple token auth based access control for API calls

super simple.  please include.  allows running of hydra nodes on "public" servers with at least some form of security.  do not need to overthink this.  yes, it's a shared secret.  backward-compatible.  auth not required.  using more complex or "standard" auth would make jsonp difficult if not impossible to implement.