Feature/appengine

All writable API methods now support two kinds of authentication.

1.  User authentication: Those requests have to been done with OAuth2 authentication (with at least the `email` scope). Currently if there is an `Account` that matches the email address, the request will be allowed. If we feel it is necessary we can narrow this down further, e.g. so that GDEs are only allowed to edit their own entries.

2.  `api_key` authentication: For this you can add an `api_key` parameter to the request. Since I didn't want to have the API Key public in the source (which would defeat its purpose) I create a `secrets.json` file in the [cloud storage of the project](https://console.developers.google.com/project/apps~omega-keep-406/storage/omega-keep-406.appspot.com/). The app reads the `admin_api_key` from this file and compares it to the one in the request. If you need this key for a script you can download the file and copy it from there. Please only use this key in non-public scripts (like maintenance apps scripts) and not in any user-visible code (like in our front-end).


/cc @patt0 for review :)