SECURITY: allow UI endpoints to use access token authentication (take 2)
Created by: slimsag
This is a rebased version of #874. Please see individual commits for details.
This change is for supporting #800
This PR does not need to update the CHANGELOG because not really user-facing.