add token_authenticatable
add sessions controller
allow sign out via GET in dev