Password based authentication

[powellnorma]

So that not any app (or even extension) can access all of AW's data. Web-UI would also need to authenticate with a password (login could be saved via cookie, though). The Client-Libraries (python + JS) would have to get updated

[powellnorma]

Perhaps it would be enough, to simply add an HTTP-Header that contains the password for each API request. One optimization would be to hash that password twice - once client-side, once server-side. That way, the plain password is not included in the http headers.

In case the password is wrong, the backend could just return a 403. Additionally, we could add logic such that after e.g. 10 consecutive wrong passwords, for ~10s we always return 429 (Too Many Requests) or 423 (Locked)