Now that we're adding REST API endpoints to the Kibana server (see #5199), we need a way to secure them. We need to prevent CSRF, but we can't just generate CSRF tokens per page load because a user might be hitting these endpoints from a client we don't control (e.g. configuration management system automatically bootstrapping a Kibana instance). As a result we'll need to implement an API token system that gives these users access to the API in a secure manner.

Some discussion points:

• Should these endpoints be accessible by both API token and session + csrf token so the existing Kibana frontend can use them without being converted to use API token?
• How do we generate the token? Do we use something like JWT?
• Do we need to persist the token? Where will they be persisted?
• How do we leverage Shield, since Kibana itself doesn't have a concept of users?