Refactor token classes to reduce duplication, improve API compliance

This implements the latest tweaks to the token derivation/encrytion
scheme, and uses the new level of symmetry between operations to support
a substantial refactor and cleanup.