change 'active' to type boolean
cleanup authenticate method
make generateToken method public
add LoginToken migration
add LoginTokenFixture
refine cookie auth
complete user tests