token based authentication

support authentication via session id, access tokens or username/password
allow creating access tokens for a user
do not create a session automatically (this needs work to figure out when not to create sessions, or maybe we always want them for security audits tbd)
no longer accepts a SHA-256 hashed password via username/password auth (this needs a change in the web interface)