Underscore internal `_getLoginToken` and `_setLoginToken`.

`closeSessionsForTokens` doesn't need to clone `sessionsByLoginToken`
because `onClose` callbacks are deferred.

Simplify `closeTokensForUser` by using `_.pluck`.