Some sessions may want to automate tasks against the CCM API. A session token is issued as PAT and is valid for the duration of the session.

The session token should only have access to read-operations, not write-operations. Therefore, it's required to implement fine-grained tokens before this PR can be merged.