Token Authentication

As a first pass, I don't think we need to go full blown user management here. But allowing the service to only be reachable from an authenticated user might make this approachable for people who don't want their data visible to the world.

Perhaps we allow an environment variable that sets a token (user supplied) and, if set, we require the token to be passed before returning anything from the endpoint. The endpoints would still do incrementing without the token, but no data returned.

Thoughts?

The issue does not name files or tests, so start by locating the service endpoint handlers and their existing request flow. Clarify the token configuration and authentication behavior with the maintainers; done should mean configured tokens protect returned data while endpoint increments still work without a token.

Written by the indexing model from the issue text.