REST Security (opening up the API to the network)

We need to set up proper API security using authentication and HMAC.

First version I propose is that the key is stored on the file system and local clients can simply read it. This is [how the Deluge daemon does authentication](http://dev.deluge-torrent.org/wiki/UserGuide/Authentication).

To add a non-local watcher we'd want some form of pairing, but non-local watchers are not a priority and not required to work for issue to be closed.