Add loopback.token() middleware
Update session / token documentation