Properly handle auth verification #3
Description
Currently, the API is unprotected. It should expect an Authorization token in the headers that the service checks to verify the caller identity before sending any emails. This is a hard requirement before "release".