use Token#authenticate for authentication

This will return the user. But we can add timestamp validations and updates here.
expire token according to config setting auth:token_expires_after