extend `Client` with API tokens for client authentication

Currently the `Client` has no provision for using API tokens.

Note that there is no design yet on server-side for this feature, and since server-side is is going to dictate the details about header names and data formats, we need to wait on that before we can make any progress here.

So this is just a placeholder issue that will be linked to its server-side twin as soon as it comes up.