Permanent Access Tokens for protected API routes

### What do you want and why?

My team is using Retool.com to create internal tooling for our Blitz.js app.
The plan is to create API routes within the Blitz app and then send request to these endpoints from Retool.
Ideally, I could generate a personal access token like GitHub offers which can then be used to access protected routes.

### Possible implementation(s)

@flybayer suggested on Discord that a workaround could be to create a new custom API route that verifies your access token. Then if good, it passes parameters on to the query/mutation like this:

```
await getUsers(
params,
{session: {
$authorize: () => {},
$isAuthorized: () => true}
}}
)
```

### Additional context

None.

No files or tests are identified in the issue. Start by reviewing Blitz.js protected API route authentication and the proposed custom API route workaround, then define how personal access tokens would be generated, verified, and used; done means a token can access protected routes from Retool.com.

Written by the indexing model from the issue text.