Fixed request handlers to return based on package=webapp or not.
Added token-based authentication to JSON API.