Create "API Token" setting and send it with requests

[groovecoder]

Django Rest Framework - as it should - enforces CSRF protection when using SessionAuthentication.

The browser extensions execute their form and AJAX requests from the bug domains. (e.g., github.com) So, the HTTP Referer - github.com - does not match the server-side domain - codesy.io, and the CSRF validation fails.

So, we need to change DRF to TokenAuthentication, which doesn't enforce CsrfMiddleware 'Referer' matching, and is probably better anyway. To do so, we should:

• Change DRF to TokenAuthentication codesy#72
• Create post-install "first run" experience #25 After install, on the first run with the extension, open settings panel with an "API Token" input field for the API token
• Update the browser extension(s) code to send Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b with requests.

[jdungan]

Fix via #40