Add simple API TOKEN for mutation queries.

[chrisbc]

We want to keep this API open until more controls are needed , but for now we should make sure that mutations require an API key.

[chrisbc]

Proposal is that

• read-only access (as required by simple_toshi_ui) will require no credentials
• mutation access (as required by rupture gen tasks, etc) must supply a valid API key

A custom auth function makes sure that any muation quereis not having a valid TOKEN are rejected