provide command line options for disabling security and tokendetailURL
implement String() on controllers and endpoints
handle non-200 responses from token-detail-url
godoc on rest.NewEndpoint()
lazy-open database