Separate out context and view aware resource class
Add support for user-derived API tokens

The root endpoint now accepts a POST request with username and password.
If authentication succeeds, a token will be returned and can be used
for SERRANO_TOKEN_TIMEOUT seconds (defaults to SESSION_COOKIE_AGE).

Clients that do not support cookies will need to re-authenticate after
the timeout has been reached.

Fix #27