Connect an API key

Validated against via GET /v1/usage. The key is stored only in this browser (localStorage) and sent only to this origin.

Tip: open /console?token=<key> to auto-connect — the token is consumed and immediately stripped from the URL.