remove body from factory because the model callbacks populate the key and expires_at
add and active scope to Token model for Tokens that are not expired
add authorization checks around UsersController#create