Sending authorized requests from the Swagger UI

The spec declares an HTTP bearer scheme on each operation that needs authorization. Without a token, you can call only the public operations, such as GET /schema; the others answer 403. To call them:

1. Get a token from the front-end. api/ does not issue tokens: it sends the token to the authorization callback of the front-end, which decides on the call. The demo panel gives a token on its account page (see the panel user guide).
2. In the Swagger UI, select Authorize, paste the token and select Authorize again. The Swagger UI then sends the token as Authorization: Bearer <token> with each request.
3. When the token expires, the calls answer 403 again. Get a new token and replace it under Authorize.