Ticket listing and resolution API access should be closed to only moderators

[alexgarel]

What

Currently, it's the frontend that checks the moderator status but the API is open…

Expected behavior

The API should be given the openfoodfacts, cookie, check that the user is a moderator and give a token to continue the work.
(refer to folksonomy engine which is doing it)

The tokens should have a reasonable expiry and can be stored in the table.

Note by Pierre: ticket creation API should of course be public