finalize the API - add a check for checking user access rights

Relevant if you: - use the boxing API (and almost everyone uses it), i.e. you have at least one "user" whose login and hash "shine" somewhere on the site - take care of your information security A very important task in terms of data security. At the moment, boxing does not check what can be given in response to a request, and what cannot! Situation: - we passed the login and hash to external developers, so that they embed it on the site and upload leads to our box - i.e. this API key is ONLY needed for uploading leads And now the most interesting: someone somehow miraculously learns / gets / intercepts the login and hash values goes to the site crm-onebox.com and takes information from the public knowledge base on how to write requests writes a request to get ALL contacts, ALL processes, DELETE contacts, DELETE processes, etc. and fulfills them as a result, at one fine moment it may happen that the box will have to be restored from a backup, but by that time the da