WIP records: REST API addition

I think we need to support both unauthenticated and authenticated requests. Perhaps ``require_api_auth`` can take a parameter ``require_api_auth(require=False)`` or similar, that can be used to only start the authentication process if e..g access token is given.