API Keys for non user devices

[steveliedtke]

Non user devices need to use api keys (via https) instead of being a user in an ldap (for example).

With an admin page the api keys can be created/blocked, etc.

It would be nice to have a functionality were the device checks every hour and tells how often it called the osn after the last check. The server holds this information in memcache and if the amount of calls is inconsistent, the api key will be blocked temporary (with an email sent to the admin).

[steveliedtke]

additionally allow only specific ip addresses or ranges with request.getRemoteAddr()