auth.access-token
Issue an API's HS256 access token, read one from an Authorization header, and refuse revoked or superseded ones.
A group of 3:
issueAccessToken, readAccessToken, confirmAccessToken