Support accepting authentication token

Currently REMS can be authenticated two ways: login flow and API-key. Instead of requiring the full login flow, we could support:

- accept token instead of code in the web app, so you can initiate access to REMS UI with it instead of login flow
- accept token in the API instead of `x-rems-api-key` & `x-rems-user-id`

Start by tracing the existing login flow in the web app and the API-key authentication path in the API. Define how a token is supplied and validated in each path, then confirm that both UI access and API requests work without the full login flow or the existing API-key and user-ID headers.

Written by the indexing model from the issue text.