revoked access to website for coaches, added web-specific tokens

website/js/api.js

@@ -7,6 +7,7 @@ function getToken() {
 async function apiFetch(endpoint, options = {}) {
     const token = getToken();
     const headers = options.headers || {};
+    headers['X-QDB-Client'] = 'web';
     if (token) headers['Authorization'] = `Bearer ${token}`;
     if (!(options.body instanceof FormData)) {
         headers['Content-Type'] = 'application/json; charset=UTF-8';