* Implement Plugins API Token schema

* Work with domain change grace period

* Do not cast internal data, extend schema with hints

* Implement Plugins API authorization

* Test no authorization header passed

* Preload authorized site

* Fixup typespecs