Change access to API (#686)

* Update API.md

* Update API.md

* Update API.md

* Update addons.py

* Update addons.py

* Update addons.py

* Update addons.py

* Update __init__.py

* Update security.py

* Update security.py

* Update const.py

* Update validate.py

* Update __init__.py

* Update validate.py

* Update homeassistant.py

* Update homeassistant.py

* Update homeassistant.py

* Update addon.py

* Update addon.py

* Update homeassistant.py

* Fix lint

* Fix lint

* Backward combatibility

* Make token more robust

* Fix bug

* Logic error

* Fix access

* fix valid

API.md

@@ -1,4 +1,4 @@
-# Hass.io Server
+# Hass.io
 
 ## Hass.io RESTful API
 
@@ -27,6 +27,9 @@ For access to API you need set the `X-HASSIO-KEY` they will be available for Add
 ### Hass.io
 
 - GET `/supervisor/ping`
+
+This API call don't need a token.
+
 - GET `/supervisor/info`
 
 The addons from `addons` are only installed one.
@@ -412,6 +415,8 @@ Proxy to real websocket instance.
 
 ### RESTful for API addons
 
+If a add-on will call itself, you can use `/addons/self/...`.
+
 - GET `/addons`
 
 Get all available addons.
@@ -510,7 +515,6 @@ Get all available addons.
       "CONTAINER": "port|[ip, port]"
     },
     "options": {},
-    "protected": "bool",
     "audio_output": "null|0,0",
     "audio_input": "null|0,0"
 }
@@ -518,6 +522,16 @@ Get all available addons.
 
 Reset custom network/audio/options, set it `null`.
 
+- POST `/addons/{addon}/security`
+
+This function is not callable by itself.
+
+```json
+{
+    "protected": "bool",
+}
+```
+
 - POST `/addons/{addon}/start`
 
 - POST `/addons/{addon}/stop`