Implements PlSession::apiAuth. The authentication is based on a HMAC

Implements PlSession::apiAuth. The authentication is based on a HMAC
signature, which takes into account the resource, the payload, and the
current timestamp.

It effectively blocks any replay beyond "the same method, within 10
seconds", which is deemed an acceptable risk, as long as API methods are
idempotent.

Signed-off-by: Vincent Zanotti <vincent.zanotti@m4x.org>