mention the tokens

Author: Vladimir Kotal

apiary.apib

@@ -4,7 +4,9 @@ HIFORMAT: 1A
 
 OpenGrok RESTful API documentation. The following endpoints are accessible under `/api/v1` with the exception of `/metrics`.
 
-Besides `/suggester`, `/search` and `/metrics` endpoints, everything is accessible from `localhost` only.
+Besides `/suggester`, `/search` and `/metrics` endpoints, everything is accessible from `localhost` only
+unless authentication tokens are configured in the web application and used via the 'Authorization' HTTP header
+(within HTTPS connection).
 
 ## Annotation [/annotation{?path}]