auth: move token related stuff to token.go file
auth: s/newToken/newUserToken/
db: add tokens collection

This collection will store all tokens. No more token embedding.
auth: move tokens to their own collection in the database
api: fix token related tests