Move tokens out into their own config files

This better reflects how they are deployed. Tokens change per
organisation but general configuration does not.

@maxfliri
@robyoung