only allow token authentication for the API

First the clients need to use token auth

(from redmine: created on 2013-09-06, closed on 2014-03-18)

• Relations:
  • parent #3518 (closed)