Using api without sending passphrase

[fix]

In order to prevent from sending passphrase through the API, on opening an account, it should be done the following way.

1. user request opening an account sending publicKey (/api/account/open?publicKey=...)
2. server create a random token, encrypt it with publicKey and send it back
3. user decrypt it with private key and send the token back to server (/api/account/open?publicKey=...&token=...
4. server compare both tokens. If equals, the user is auth.

Ideally the IP should be matched, and token invalidated if IP change or after some time.

as for creating transactions, it should be clear in the doc that the API cannot be used safely, but lisk-js instead.

[fix]

closing it as duplicate of #39