Propper access tokens

Add support for propper generation and verification of access tokens.
This replaces the overly simplistic and shortlived request token.

Token management is the responsibility of the SecurityEngine.