Trims surrounding whitespace, because tokens are usually read from an environment variable or a file that carries a trailing newline. Rejects an empty or blank value and any value containing a control character, since such a value cannot be put in a header without splitting the request.
The returned ValidationError describes the failure on the "apiToken" field and never echoes the rejected input.