This enables the use of project and group access tokens for sessionless
API authentication. The primary effect of this is to allow the use of
project and group tokens in the GraphQL API.

The documentation is updated to explain a little how project tokens are
implemented, which is useful for future maintenance.

Changelog: changed