Support token auth for developers

[parente]

Discussed multiple levels of tokens. First level is just put a key in student nginx.conf files. Second is allow from localhost. UOW server checks to ensure key presence or localhost IP.

[gbishop]

Auth code is currently in jsonreststore, but I wonder if it should be? Store's clearly need auth info but I'm not sure that server should generate it. Perhaps split that part out?

[parente]

I didn't mean true auth. I meant this issue as a way to track adding the hardcoded X-UOW-Token header to our student nginx.conf files and check for it on the UOW server.

[parente]

This won't be needed when Gary gets his real auth integrated, right?

[gbishop]

correct. Still might be nice to be able to distinguish this as an extension of local access. I could see limiting administrative functions to "local" machines (as in on campus). The presence of the token might get your remote machine treated as local.