Token Authentication

As a first pass, I don't think we need to go full blown user management here. But allowing the service to only be reachable from an authenticated user might make this approachable for people who don't want their data visible to the world.

Perhaps we allow an environment variable that sets a token (user supplied) and, if set, we require the token to be passed before returning anything from the endpoint. The endpoints would still do incrementing without the token, but no data returned.

Thoughts?

该 issue 没有指定文件或测试，因此请先定位服务端点处理程序及其现有的请求流程。与维护者确认 token 配置和身份验证行为；完成的标准应是，已配置的 token 能保护返回的数据，同时端点递增仍可在没有 token 的情况下正常工作。