Improve management of API access tokens

[fabian-marquardt]

Currently this is still very clumsy and creating a proper deployment of the system is unnecessarily painful. I have some ideas of how this can be improved. I think we should talk about this next week in person, I just leave this issue here as a reminder.

[thegcat]

Short summary:

• Verify if tokens can be generated and obtained via web API
• How would verification/confirmation of the token look like?
• Potentially have a pre-shared-secret protected page to confirm token requests