Add a contact method (unverified). First of a kind becomes primary.

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.