auth: generalize token functions

BREAK ALL THE THINGS. This is part of a huge refactoring. Handlers
aren't going to receive users anymore. Instead, they will receive token
instances.
auth: added User method to Token type

This method will return the user instance matching the current token.
auth: simplify AuthenticationFailure declaration
auth: remove GetUserByToken function

Now Token contains a method called User :-)
auth: don't try to remove a key that does not exist
api: change handler signature

Now handlers receive the token, not the user. It will be used for
application token validation (each handler should check if the token is
appropriate for each action).

Related to #286, #287, #288, #290 and #291.
api: fix go vet warning
check-fmt: fix go vet checking

In Go 1.1, go vet will send its warnings to stderr, not stdout.