Use token-based auth

[wlonk]

So that we will only display info to the accredited client. That way I control both the client and the server and can proceed accordingly. Inject the token into the client via env variables.