support giving the secret token at any time to authenticate the current request

can be either given via a post form field 'token' or even a query string argument '&token=...' (we do not recommend the latter one, though).

this is useful for cli clients that do not support http auth nor cookies, but need to authenticate.