Allow completely restricting /api/ endpoints to those with authorization

[wlach]

For the internal mozilla use case, we would like to be able to restrict any access to /api/ to those clients with either a token or a valid session. Currently we rely on openidc auth for these endpoints but this approach doesn't work well with the ajax approach we use inside the notebook.

For this to be useful, we need #1755 first.

/cc @robotblake