Authenticate one of the caller's end-customers (email + password)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.