Introduce authentication and basic authorization in the server.

- When enabled, all requests must be authorized using an authorization token
- Token is acquired by authenticating with a username/password tuple.
No, this is for the username, rather than the token - but you're right this is inconsistent for validating the two. I'll have a look and see what I can do.