Change authentication workflow

[avavilau]

• Core must only support authorization via key or token, not both
• Application must receive tokens with restricted to its client_id

[astsiapanay]

Some clarifications about the task:

[4:09 PM] Aliaksandr Stsiapanay
Questions
1.
Supposing just token comes in the request
We always validate user token in this case anyway. (verify signature)
As a result the field Key.userAuth is no longer needed.
2. API key
User roles are empty in this case.
3. User token
We just validate user roles but we don't validate limits on tokens per model because API key is missed.
Supposing user have unlimited access.

Is that correct?
[4:14 PM] Aliaksei Vavilau
Correct