Slight refactor so User.authenticate returns false when fails.
Added token and sign in timestamp to user model with specs.