REST API features

[kamikazechaser]

• Support both a service API key and end user authentication and authorization (Though the deployments should be separate just to reduce damage in the event of a critical security issue).
• Middlewares for further checks on request parameters. E.g. banned tokens, pools and users
• Optional rate limiting based on both origin I.P address and publicKey. This is particularly useful for publicly exposed custodial endpoints.
• CORS support

[kamikazechaser]

Switched to EdDSA JWT only. Services can get long lived JWT via the gen-service-token CLI. Default expiry is 1 day for non-service use cases.

[kamikazechaser]

We should probably move to a framework that supports finer control over middleware. Echo suffices for now but may introduce a lot of boilerplate and repeated code.