REST: Remove Use of Password

[alexanderbez]

Summary

The password field in the base_req of POST requests should be removed entirely or heavily documented as unsafe.

Problem Definition

Even with a REST client sitting behind a secure network layer/proxy, it is not advisable to accept key passwords in plain text such as this.

Proposal

We already have generate only and tx broadcast support, so we should enforce (encourage) clients to sign the txs before sending to a specific node.

In other words, we:

• Remove the password field (thus removing the dependency for Keybase)
• Force all module tx endpoints to now be generate only

/cc @cosmos/cosmos-ui

ref: #3560

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[fedekunze]

we are not using it now on Voyager, we do generate_only > sign > broadcast

[alexanderbez]

@fedekunze music to my ears!

[fedekunze]

although this is a breaking change

[alexanderbez]

Update, we may not even need this with #3640. Where most clients will not have unsafe routes enabled.