Securing an API key/token

As our sessions will be based on a token, we need to secure that authentication token. There are different things that need to be done for that:

1. Not passing an access token in the URL.
2. Access token expiration.