Issue a short-lived JWT bearer token for the requesting account. Authentication
for this endpoint uses the api-key header (not bearer auth). The returned
token is valid for 4 hours; clients should refresh before expiry. Use the
returned jwt in the Authorization: Bearer <token> header on all other
endpoints.