Introduce authentication and basic authorization in the server.

- When enabled, all requests must be authorized using an authorization token
- Token is acquired by authenticating with a username/password tuple.
It looks like this check is already implied by the IllegalTokenException thrown by `save()`. It makes sense then to consider these to be implementation details and as such they should not be part of the interface.