JSON routes do not need it but added for consistency

Those tokens are only created by the login route so
those should not allow users to authenticate if the login route is disabled

The login route is now disabled by default.
It was previously enabled by default.
It is why it is a breaking change.

Mount on "/" when we are on an older version of cubicweb missing the receives-base-url-path OR when the receivese-base-url-path option is set to False. This option has been added in version 4.2.

Otherwise we are serving our routes on the full base url.

Closes #34.

Closes #702.

Only log exception when it leads to a 500 error.

Otherwise exceptions raised on commit are not caught by the api exception view deriver.

refactor(exceptions): define custom api exception, a view deriver to raise them and view exception to display them