Use API token to authenticate requests to badge endpoint

The browser extension currently relies on cookie authentication to authenticate requests to the badge endpoint. When the client is using OAuth, it should instead use the current OAuth access token to authenticate requests to the badge endpoint. One complication here is that the access token may have expired and the client may not be running to refresh it.

- [ ] Provide an API-token authenticated way to request the annotation counts for the current page
- [ ] Use API tokens to authenticate requests from the browser extension to this endpoint
- [ ] Make sure that API tokens are refreshed if necessary, even if the client is not currently running