API Authentication Improvements

[DaneEveritt]

Discussion is welcome here.

• Firstly, the IP checking within the API needs to be modified a bit to allow for CIDR notation so we don't necessarily have to store a huge quantity of IPs in the database.
• Secondly, the secret token for the API, consider ideas for how to securely store this in the database. We could encrypt it, which would protect it in the event that the database is compromised, but not in the event that the database and code are compromised since they would then get access to the encryption token. We could also just store it as plaintext.
• Important: the current method of signing the request before sending it is missing the request type (i.e. POST, GET) which could allow for a reply-attack to target a different method (i.e. intercept GET and then change the method to POST).
• Additionally, consider adding a timestamp which could prevent a reply-attack if the time is not within x minutes of the server time. This opens up issues with systems that have vastly different times (i.e. differ by hours or days). This can also just be mitigated by using HTTPs.

[DaneEveritt]

Encryption of secret keys was added in 317698a

CIDR was added in c701aa0