Token in HTTP header and more settings

Merges changes from August Lilleaas and Daniel Westheide
  * extra configuration options for middleware (excluded routes, token-generation callback and callbacks for invalid queries and logging)
  * option to store token in request header (with documentation and tests)
  * function to create html meta tags (for easier access from javascript)

Currently the history is a bit messy as the two merged branches duplicate some work.  Can rewrite to fix it but would loose authorship information.