Normally you log into the Turnkey site manually - and the application has a auth-scheme set up. But if you want to allow api logon with and use the rest call Logon - and if you in that case want to be able to verify a sent in bearer token as being valid concerning a set of criteria's and if so then accept the user...