Added some constants (needed for the earlier revision)
"id" is not a required attribute
Changed User -> UserToken relation slightly
Renamed the "expires" column to "created", this way the token lifetime
can be changed after a token has been created. Also fixed some
validation rules and factored out the token generation code to a
separate method and removed beforeSave()
Tokens are now returned (and updated in case of expiration) when a
user authenticates successfully