Basic token authentication scaffolding

Added some basic authentication for tokens in the Authorization header.
We also dual authentication against forms auth coookies so we can have
webapi auto authenticate if the user is already auth'ed against the
website