Deprecate multi-auth for API and instead authenticate with just tokens

[travipross]

With all API endpoints decorated with FlaskHTTPAuth.MultiAuth, it basically defeats the purpose behind supporting API tokens at all.

Another view could also be created for requesting tokens from the UI.