More robust user authentication

[giulioturetta]

cf. https://stackoverflow.com/questions/2786628/preventing-dictionary-attacks-on-a-web-application

[yurj]

Async frameworks should have some sort of throttle mechanism.

[RastislavHudak]

The problem is that currently the api is often used by providing basic auth on each call instead of using a token. This means that adding checks here will affect/slow down almost every api call.